MITRE ATT&CKgroup
G0003 Cleaver
- Domain
- enterprise
- Aliases
- Threat Group 2889, TG-2889
- Version
- 1.3
- Created
- 2017-05-31
Description
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).
Related
Uses · MITRE ATT&CK (9)
- T1557.002 ARP Cache Poisoning sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1003.001 LSASS Memory sub-technique
- S0002 Mimikatz software (tool)
- S0004 TinyZBot software (malware)
- S0029 PsExec software (tool)
- S0056 Net Crawler software (malware)
References
- https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf Cylance Cleaver
- http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/ Dell Threat Group 2889