Cleaver
threat actorIRalso known as
Other names and identifiers for this entity.
ATT&CK
Cleaver · TG-2889 · Threat Group 2889
MISP
Alibaba · Cleaver · Cobalt Gypsy · Op Cleaver · Operation Cleaver · TG-2889 · Tarh Andishan
A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.
resolved ATT&CK groups
Threat groups associated with this.
related actors
Related entries.
- CHRYSENE· likely
- Charming Kitten· likely
- Clever Kitten· likely
- Cutting Kitten· likely
- Flying Kitten· likely
- OilRig· likely
- Rocket Kitten· likely
techniques used (5)
ATT&CK techniques this enables or maps to.
software used (4)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://www.secureworks.com/research/the-curious-case-of-mia-ash
- https://www.cfr.org/interactive/cyber-operations/operation-cleaver
- http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-goldfish-when-kittens-go-phishing
- https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations
- https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/
- https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-spy-kittens-are-back.pdf
- https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf