RASPITE

RASPITE is Dragos's designation for an Iranian-linked threat group active since at least 2017, focused on initial access operations against electric utility organizations in the United States, Europe, the Middle East, and East Asia. The group gains access through strategic website compromise (watering hole attacks) targeting websites of interest to utility sector personnel, embedding links that prompt SMB connections to harvest Windows credentials. After credential theft, RASPITE deploys scripts to install a malicious service providing remote access to compromised machines. Dragos assessed RASPITE maps closely to the Leafminer cluster tracked by Symantec, which documented the same underlying Iranian actor's broader targeting of government, energy, finance, and transportation sectors across the Middle East. While RASPITE's focus on ICS-operating entities is clear, the group had not demonstrated a destructive ICS-specific capability at time of reporting, indicating operations concentrated on initial access and intelligence collection as preparation for potential future actions against critical infrastructure.