Cleaver
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T04:46:49+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- IR
MITRE ATT&CK Techniques (5)
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. Thi
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a
Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p
Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to
Software & Tools (4)
Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along
Net Crawler is an intranet worm capable of extracting credentials using credential dumpers and spreading to
PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT
TinyZBot is a bot written in C# that was developed by Cleaver. (Ci
Explore this actor's full graph with Ninja Signal