Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Cleaver · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

Cleaver

  • Operation Cleaver
  • Op Cleaver
  • Tarh Andishan
  • Alibaba
  • TG-2889
  • Cobalt Gypsy
  • G0003
  • Threat Group 2889

state sponsor · Iran (Islamic Republic of)MITRE G0003 ↗

Cleaver — ATT&CK roseCL

attack rose · 5 techniques across 2 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2010-0232

Analyst brief

misp-galaxy + mitre-attack

A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.

Observed targets (as stated by the sources)

15 countries · 7 sectors
CanadaFranceIsraelMexicoSaudi ArabiaChinaGermanyUnited StatesPakistanSouth KoreaUnited KingdomIndiaKuwaitQatarTürkiyeAssessed origin: Iran

assessed origin · Iranobserved targets · 15

countries · 15

  • Canada
  • France
  • Israel
  • Mexico
  • Saudi Arabia
  • China
  • Germany
  • United States
  • Pakistan
  • South Korea
  • United Kingdom
  • India
  • Kuwait
  • Qatar
  • Türkiye

sectors · 7

  • Private sector
  • Government
  • Defense
  • Energy
  • Technology
  • Government, Administration
  • Academia - University

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

5 techniques · 2 of 15 tactics

  1. Resource development

    3 techniques

  2. Credential access

    2 techniques

select a technique

Arsenal

2 malware · 2 tools
Malware
Malware · 2ATT&CK
Net CrawlerS0056 ↗
TinyZBotS0004 ↗
Tools
Tools · 2ATT&CK
PsExecS0029 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Cleaver is cited as exploiting

none on KEV
  1. CVE-2010-02322026-10-17
    1. “This team did not utilize any novel methods of privilege escalation, but they were observed using a variety of publicly known exploits. PrivEsc is a compiled exploit, which leverages the vulnerability commonly referred to as KiTrap0D (CVE-2010-0232).”

      cited as exploiting · named nearby · source: scadahacker.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2014Operation Cleaver: The Notepad FilesCylance ↗

Take it with you

keyless · no signup

References

17 sources
  1. 1.secureworks.com/research/the-curious-case-of-mia-ash
  2. 2.cfr.org/interactive/cyber-operations/operation-cleaver
  3. 3.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based…
  4. 4.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-…
  5. 5.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations
  6. 6.blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customer…
  7. 7.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-pape…
  8. 8.blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
  9. 9.attack.mitre.org/groups/G0003
  10. 10.xorl.wordpress.com/2021/05/06/iran-cyber-operations-groups
  11. +7 more in the JSON record

Track Cleaver on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.