Skip to content

Cleaver

Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).

ATT&CK ID: G0003
Origin: Iran
Techniques: 5
Tools: 4

Also tracked as Threat Group 2889 · TG-2889

Techniques

Resource Development

Establish Accounts Develop Capabilities Obtain Capabilities

Credential Access

OS Credential Dumping Adversary-in-the-Middle

Collection

Adversary-in-the-Middle

Software

Mimikatz · Net Crawler · PsExec · TinyZBot

MITRE ATT&CK All threat actors