Leafminer

Leafminer is Symantec's designation for an Iranian cyber espionage group active since at least 2017, also tracked as RASPITE by Dragos. The group targets government, energy, financial, transportation, and shipping organizations across the Middle East, with documented victims in Saudi Arabia, the UAE, Qatar, Kuwait, Bahrain, Egypt, Israel, and Afghanistan. Symantec's investigation uncovered a Farsi-language list of 809 target organizations compiled by the group, grouped by geography and industry, providing rare visibility into Iranian APT targeting priorities. Leafminer gains initial access through watering hole attacks and spear phishing, using a mix of publicly available tools alongside custom malware. Dragos's RASPITE research identified the same actor targeting US electric utility organizations, making Leafminer/RASPITE one of the first documented Iranian groups to focus on ICS-operating entities — though without demonstrated destructive ICS capability at time of reporting. The group's Iranian origin was assessed based on Farsi-language artifacts and targeting patterns consistent with Iranian state espionage priorities.