What tactics and techniques does Leafminer use?

How Leafminer Gets In and What It Tries to Achieve

Leafminer combines initial access techniques with post-compromise tradecraft. The intrusion chain is built around convincing delivery, stealthy footholds, and then using that foothold to expand access inside the environment. For defenders, the important point is that the campaign is not just about entry, it is about turning one successful compromise into broader access.

The initial phase usually relies on MITRE ATT&CK Enterprise Matrix as the best lens for mapping the full chain of adversary behaviour, because the campaign spans initial access, credential access, and lateral movement. That makes it easier to separate the delivery method from the follow-on activity that often matters more operationally.

The Main Tactics and Techniques Behind Leafminer Activity

Leafminer uses spearphishing, web compromise, and malware-based backdoors to gain entry into targeted organisations. Those techniques are complementary: phishing reaches users, web compromise can seed access through trusted infrastructure or visited content, and a backdoor gives the operator a durable command path after the first foothold.

Once inside, the campaign steals credentials and uses them to move laterally toward higher-value systems. That pattern is consistent with a threat actor that wants to convert a single compromised endpoint into broader internal access, rather than remain confined to one host.

For teams tracking campaign structure rather than just one symptom, Threat Actor Groups Guide is useful because it helps place Leafminer in the broader context of how threat groups are named, tracked, and compared across reporting sources.

What Defenders Should Watch For in a Leafminer-Style Intrusion

The strongest indicators are behavioural: suspicious login activity, unusual internal scanning, process execution from user directories, repeated beaconing, and unauthorised remote access. None of those on their own proves Leafminer, but together they point to a live intrusion with both access and movement inside the network.

When those signals appear alongside phishing or web-based entry points, defenders should treat them as a campaign progression problem, not a single host problem. That means correlating endpoint, identity, and network telemetry to determine whether the actor is still establishing footholds, harvesting credentials, or probing for additional targets.

Because phishing is a common entry path in this kind of campaign, Top 10 Phishing Techniques is a practical companion for understanding the delivery methods that often precede the compromise.

Risk and Threat Considerations

Leafminer’s technique mix is risky because it creates both initial compromise and internal spread. Once credentials are stolen, the attacker can blend into normal access patterns, which makes detection harder than a simple malware alert on one machine.

Failure mechanism: A successful phishing or web-compromise event yields a foothold, then stolen credentials and backdoor access let the operator pivot internally and probe sensitive systems without needing repeated external exploitation.

Impact: The organisation can face broader compromise than the original entry point suggests, including access to sensitive systems, exposure of internal data, and a longer dwell time if lateral movement is not contained quickly.

Practitioner Guidance

What to verify: Confirm whether suspicious logins line up with new internal scanning, remote access from unexpected hosts, or processes running from user-writable locations. Those combinations matter more than any single alert because they show progression from entry to internal activity.

Decision rule: If a host shows repeated beaconing plus credential abuse indicators, isolate it first and then work outward from the account and network paths it touched. If the same identity is reused on multiple systems, treat credential rotation and session invalidation as part of containment, not a later cleanup step.

Practitioner takeaway: The key judgement is to treat Leafminer as a chain of access, credential theft, and movement, not as a one-off malware infection, because containment depends on breaking the attacker’s ability to reuse trust inside the environment.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?