Leafminer Cyber Espionage Campaign Targets Middle Eastern Governments

Between 2017 and 2018, an Iran-based threat group called Leafminer ran a broad espionage campaign against government bodies and businesses across the Middle East. The group used a mix of techniques to break into targets — watering hole websites, known software vulnerabilities, and brute-force password attacks — then deployed custom malware and off-the-shelf hacking tools to steal email data, files, and database contents. Symantec uncovered the campaign after Leafminer made a significant mistake: they left a staging server publicly accessible, exposing their entire toolkit, operations logs, and a Farsi-language list of 809 target organizations.

The attacks were carried out by Leafminer, a threat actor assessed by Symantec to be based in Iran. Clues pointing to Iranian origin include the Farsi-language target list, references to the Iranian hacking forum Ashiyane in the web shell code, and connections to the Iranian hacker group Sun Army through the malware developer alias "MagicCoder." The group is considered a relatively newer entrant with significant ambition but uneven tradecraft — they adopted advanced techniques quickly but made basic operational security mistakes that exposed their entire operation.

The primary goals were intelligence collection and data exfiltration. After gaining access to target networks, Leafminer focused on stealing email data (using MailSniper to search Exchange servers), documents and files (using indexing and file-copying tools), and database contents. The recovered target list — with 809 organizations grouped by industry and country, all written in Farsi — confirms this was a systematic intelligence-gathering operation directed at a broad range of regional strategic and economic targets.

The campaign was broad in geographic and sectoral scope. Symantec confirmed active malware infections on 44 systems across four Middle Eastern regions, with targeted countries including Saudi Arabia, the UAE, Qatar, Kuwait, Bahrain, Egypt, Israel, Lebanon, Azerbaijan, and Afghanistan. The recovered 809-target list spanned government agencies, finance, energy, aerospace, transportation, construction, telecommunications, food and agriculture, and utilities — indicating Leafminer was targeting critical national infrastructure and key economic sectors across the region.

Leafminer targeted government organizations across the Middle East as a primary focus, alongside sectors including finance, energy, aerospace, transportation, construction, telecommunications, food and agriculture, and utilities. The Farsi-language target list organized victims by both geography and industry, suggesting the group was operating with specific intelligence collection mandates across strategic sectors of regional economies — likely reflecting Iranian government intelligence priorities in the region.

Leafminer used three main methods to break into target networks. First, they compromised legitimate websites in the region and planted hidden JavaScript code that tricked visitors' browsers into making SMB requests, which transmitted the user's NTLM password hash to the attacker — who could then crack it offline. Second, they exploited the EternalBlue vulnerability (CVE-2017-0144), a severe Windows SMB flaw originally developed by the NSA and leaked in 2017, to move laterally within networks. Third, they ran brute-force and dictionary attacks against exposed Exchange email and RDP remote desktop login services. Once inside, they used a suite of tools to dump credentials, collect emails, copy files, and establish persistent backdoors.

Middle Eastern governments and critical infrastructure operators hold sensitive intelligence about regional security dynamics, economic resources, and foreign policy — all of direct strategic interest to Iran. Saudi Arabia, the UAE, and other Gulf states are longstanding geopolitical rivals of Iran, making their government communications and economic infrastructure high-value espionage targets. The breadth of sectoral targeting — covering energy, finance, transportation, and telecommunications — also suggests an interest in mapping the economic infrastructure of adversary states, which has both intelligence and potential sabotage value.