G0003

    Cleaver

    IranState-sponsoredMITRE ATT&CKUnknown

    Observation period

    5

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Private sector
    • Government

    Target countries according to source Canada, France, Israel, Mexico, Saudi Arabia, China, Germany, United States, Pakistan, South Korea, United Kingdom, India, Kuwait, Qatar, Turkey

    Aliases

    • Operation Cleaver
    • Op Cleaver
    • Tarh Andishan
    • Alibaba
    • TG-2889
    • Cobalt Gypsy
    • Cleaver
    • Threat Group 2889

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    External references

    Back to group overview