{
  "type": "bundle",
  "id": "bundle--6e31345b-f072-5855-a29c-6cd2f9df9e5e",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "name": "Cleaver",
      "aliases": [
        "Cleaver",
        "Operation Cleaver",
        "Op Cleaver",
        "Tarh Andishan",
        "Alibaba",
        "TG-2889",
        "Cobalt Gypsy",
        "Threat Group 2889"
      ],
      "description": "A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0003",
          "url": "https://attack.mitre.org/groups/G0003/"
        },
        {
          "source_name": "skopnix",
          "external_id": "cleaver",
          "url": "https://skopnix.com/actors/cleaver"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/the-curious-case-of-mia-ash"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/operation-cleaver"
        },
        {
          "source_name": "secureworks.com",
          "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/"
        },
        {
          "source_name": "trendmicro.com",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-goldfish-when-kittens-go-phishing"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
        },
        {
          "source_name": "blogs.microsoft.com",
          "url": "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/"
        },
        {
          "source_name": "trendmicro.de",
          "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-spy-kittens-are-back.pdf"
        },
        {
          "source_name": "blog.checkpoint.com",
          "url": "https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"
        },
        {
          "source_name": "xorl.wordpress.com",
          "url": "https://xorl.wordpress.com/2021/05/06/iran-cyber-operations-groups/"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles"
        },
        {
          "source_name": "know.netenrich.com",
          "url": "https://know.netenrich.com/threatintel/threat_actor/Cutting%20Kitten"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/cyber-operations/operation-cleaver"
        },
        {
          "source_name": "securityaffairs.co",
          "url": "https://securityaffairs.co/wordpress/33682/cyber-crime/ali-baba-apt-middle-east.html"
        },
        {
          "source_name": "scadahacker.com",
          "url": "https://scadahacker.com/library/Documents/Cyber_Events/Cylance%20-%20Operation%20Cleaver%20Report.pdf"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0003"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d",
      "name": "Social Media Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.001",
          "url": "https://attack.mitre.org/techniques/T1585/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df",
      "name": "Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.001",
          "url": "https://attack.mitre.org/techniques/T1587/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc",
      "name": "LSASS Memory",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.001",
          "url": "https://attack.mitre.org/techniques/T1003/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--01425f9f-024b-513a-8337-c963ffc89b05",
      "name": "ARP Cache Poisoning",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1557.002",
          "url": "https://attack.mitre.org/techniques/T1557/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--b4974038-7328-5989-8ee3-3c491a5add17",
      "name": "Net Crawler",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0056",
          "url": "https://attack.mitre.org/software/S0056/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--f65bd47c-4670-587e-b79a-b7893de06906",
      "name": "TinyZBot",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0004",
          "url": "https://attack.mitre.org/software/S0004/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
      "name": "PsExec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0029",
          "url": "https://attack.mitre.org/software/S0029/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
      "name": "Mimikatz",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0002",
          "url": "https://attack.mitre.org/software/S0002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc5c08df-6f5a-5924-a1e3-4603c8d3e8bb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4a1f13f9-8501-5b56-87cc-b671e919954c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--53154c9a-1328-5d1c-a4cb-57b84b872e6b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9d5ebe4c-9e30-5605-8180-1523d91acfc0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e27ad385-4958-5c46-996b-cef630d9a008",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "attack-pattern--01425f9f-024b-513a-8337-c963ffc89b05"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--940e6e81-28b0-5d3a-9b7a-66b06a84a81f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "malware--b4974038-7328-5989-8ee3-3c491a5add17"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--60c47a02-40a3-5c7a-883b-90baf321861f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "malware--f65bd47c-4670-587e-b79a-b7893de06906"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--38169585-ee2a-5ce2-9e59-fb5b2c4136a7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--92769ab1-0fd8-574d-aefe-f887c1fa842f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--dcf85936-ad49-5135-b290-e0f18a1df167",
      "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
    }
  ]
}