ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G0077threat actor

Leafminer

a.k.a. Raspite

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.

MITRE ATT&CK ↗

Linked entities · 21

usesS0349LaZagne usesT1027.010Command Obfuscation usesT1588.002Tool usesT1003.001LSASS Memory usesT1555Credentials from Password Stores usesT1046Network Service Discovery usesT1003.005Cached Domain Credentials usesT1555.003Credentials from Web Browsers usesT1552.001Credentials In Files usesT1003.004LSA Secrets usesT1055.013Process Doppelgänging usesS0002Mimikatz usesS0413MailSniper usesT1189Drive-by Compromise usesT1018Remote System Discovery usesT1110.003Password Spraying usesT1136.001Local Account usesT1059.007JavaScript usesS0029PsExec usesT1114.002Remote Email Collection usesT1083File and Directory Discovery