Knowledge/Actors/CleaverCorpus

+ Request intel workspace

apt

Cleaver

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Operation CleaverThreat Group 2889TG-2889Tarh Andishan

Attribution

Iran — assessed state-sponsored (medium-high confidence)

Origin

Iran

First seen

2012

Last active

2015

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Saudi Arabia, UAE, Qatar, Kuwait

Sectors

Energy, aviation, military, transportation, critical infrastructure

MITRE ATT&CK

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Saudi Arabia, UAE, Qatar (Energy, aviation, military sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Related to

Void Manticore (Storm-0842)actorTechnique overlap
OilRig (APT34)actorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
2025 Cyber Threat Intelligence ReportreportORKL2025-06-24
2025 Global Threat ReportreportORKL2025-02-27
Botnet Command & Control Infrastructure ReportreportORKL2025-01-10
Down the Grayrabbit Hole – Exposing UNC3569 and its Modus OperandireportORKL2024-09-24
Botnet Command and Control Infrastructure Report January to June 2024

Overview Attribution² TTPs⁵ Indicators Reporting¹² Coverage

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

report

ORKL2024-07-08

←Kinsing Demystified A Comprehensive Technical GuidereportORKL2024-05-03

←Chinese APT: A Master of Exploiting Edge DevicesreportORKL2024-04-12

←Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and EuropereportORKL2024-01-12

←Botnet Command and Control Infrastructure Report Q4 2023reportORKL2024-01-11

←2023 Adversary Infrastructure ReportreportORKL2024-01-08

←Botnet Command & Control Infrastructure Tracking ReportreportORKL2023-10-12

←Botnet Command & Control Infrastructure Report Q2 2023reportORKL2023-07-12

Uses

ARP Cache PoisoningtechniqueATT&CK mapping
TooltechniqueATT&CK mapping
LSASS MemorytechniqueATT&CK mapping
Social Media AccountstechniqueATT&CK mapping
MalwaretechniqueATT&CK mapping

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

ActorOilRig (APT34)
ActorAPT33
ActorMuddyWater
ORKLInvestigating Iranian Intrusion into Strategic Middle East Critical Infrastructure ↗
ActorFlying Kitten
ActorFlame / Flamer