- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, security company ITSecTeam
- Agency named
- Islamic Revolutionary Guard Corps
- Motivation
- Denial of service; Espionage; Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0003 · 5 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0080 · cleaver
IranWhat it is
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Cutting Kitten, HELIX KITTEN, Twisted Kitten
- Mandiant
- APT 34, APT34
- Microsoft
- Hazel Sandstorm
- MITRE ATT&CK
- G0003
- Proofpoint
- TA452
- Secureworks
- TG-2889
- Thales
- ATK40
- Trend Micro
- Earth Simnavaz
- Operations
- Operation Cleaver, Operation “Cleaver”
- Other names
- Alibaba, Cobalt Gypsy, Crambus, Cutting Kitten, TG-2889, EUROPIUM, Evasive Serpens, IRN2, ITsecTeam, OilRig, Op Cleaver, SOLAR ION, Tarh Andishan, Threat Group 2889
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- AT&T, Bank of America, BB&T, Canada, Capital One, China, Citigroup, Fifth Third Bank, France, Germany, HSBC, India, Israel, Kuwait, Lebanon, Mexico, Middle East, Netherlands, NYSE, Pakistan, PNC, Qatar, Saudi Arabia, South Korea, Türkiye, United Arab Emirates, United Kingdom, United States, US Bancorp, Wells Fargo
- Sectors
- Academia - University, Aerospace, Aviation, Chemical, Civil society, Defense, Education, Energy, Engineering, Finance, Financial, Government, Government, Administration, Healthcare, Oil and gas, Other, Private sector, Technology, Telecommunications, Telecoms, Transportation, Utilities
Tools
The tools and malware families the sources tie to it.
- Arabian-Attacker RAT
- Cyber Eye RAT
- CyberGate
- Mimikatz
- Net Crawler
- PsExec
- RTM
- TinyZBot
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de