Threat Actor

Cleaver

Also known as: Cleaver, Threat Group 2889, TG-2889

[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)

5
Techniques
5
Software

Properties

stix_id
intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063
signal_observed_at
2026-09-11T17:55:00+00:00
type
intrusion-set

MITRE ATT&CK Techniques (5)

ARP Cache Poisoning

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. Thi

LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Malware

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p

Social Media Accounts

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be

Tool

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Software & Tools (5)

MimiKatz [malware]

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Mimikatz [tool]

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Net Crawler [malware]

[Net Crawler](https://attack.mitre.org/software/S0056) is an intranet worm capable of extracting credentials using credential dumpers and spreading to

PsExec [tool]

[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

TinyZBot [malware]

[TinyZBot](https://attack.mitre.org/software/S0004) is a bot written in C# that was developed by [Cleaver](https://attack.mitre.org/groups/G0003). (Ci

Explore this actor's full graph with Ninja Signal

Cleaver — Threat Actor Profile — Ninja Signal | Ninja Signal