Home / Threat actors / Cleaver
Cleaver G0003
Also known as: Threat Group 2889, TG-2889
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
6
Techniques
4
Malware and tools
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1585.001 Social Media AccountsT1587.001 MalwareT1588.002 Tool Credential Access
T1003.001 LSASS MemoryT1557.002 ARP Cache Poisoning Collection
T1557.002 ARP Cache Poisoning Malware and tools
- Net CrawlerMalwareS0056
- TinyZBotMalwareS0004
- MimikatzToolS0002
- PsExecToolS0029
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.