Leafminer

Summary

Iranian espionage group (MITRE G0077) that Symantec exposed in July 2018, active since at least early 2017 against government organisations and businesses across the Middle East. Symantec found its tools on 44 systems in Saudi Arabia, Lebanon, Israel, Kuwait and elsewhere, and a Farsi-language list of 809 scanned targets — mainly financial, government and energy organisations — that includes the UAE, Qatar, Bahrain, Egypt and Afghanistan. It relied on compromised web servers for watering holes, internal password spraying (Total SMB BruteForcer), credential tools (LaZagne, Mimikatz), MailSniper for Exchange mailbox searches and the Sorgu backdoor and Imecab remote-access account tool.

Attribution

No service publicly named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Iranian threat group

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 8

Malware and tools 2

Infrastructure patterns

• Compromised web server e-qht.az used to distribute its tools (Symantec, 2018)
• Watering-hole JavaScript planted on compromised Middle Eastern websites to steal SMB credentials (Symantec, 2018)

Reporting and advisories 2

• Symantec
  Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions (25 Jul 2018)
• MITRE ATT&CK
  Leafminer (G0077) group profile