Cleaver is an early Iranian state-linked group, documented by Cylance in 2014 as Operation Cleaver, that conducted global critical-infrastructure espionage with heavy Gulf targeting — energy, aviation, military, and transportation networks across Saudi Arabia, the UAE, Qatar, and Kuwait — signalling Iran's maturation from defacement into infrastructure-focused intrusion.
Cleaver was detailed by Cylance in its December 2014 'Operation Cleaver' report, which attributed a multi-year campaign to Iran-based actors and linked the group with strong circumstantial evidence to Threat Group 2889 (TG-2889) and the Tarh Andishan team. MITRE tracks it as G0003. The activity marked an assessed inflection point in which Iran shifted from web defacement and DDoS toward sustained, capability-building intrusions into critical infrastructure — plausibly in retaliation for Stuxnet and regional tensions.
Operationally, Cleaver combined SQL injection, spearphishing, and watering holes with a custom toolset (TinyZBot, PvzOut, Csext) and heavy use of publicly available utilities, credential theft (including domain-controller compromise), and ARP-poisoning man-in-the-middle techniques. MITRE maps the group to OS credential dumping, LLMNR/NBT-NS poisoning, and the acquisition/development of capabilities and personas — including fake LinkedIn recruiter profiles used for social engineering.
MENA and the Gulf were central to Cylance's victimology: targets spanned energy/oil-and-gas, utilities, aviation and airports/airlines, transportation, and military/defense organizations in Saudi Arabia, the UAE, Qatar, and Kuwait, alongside victims in more than a dozen countries worldwide. Cylance warned that airline and airport network access raised physical-safety concerns.
Cleaver is assessed as retired under its own name; its operators and tradecraft are widely believed to have been absorbed into later Iranian clusters (with tooling and personnel overlaps discussed in reporting on subsequent IRGC- and MOIS-aligned groups). It is included here as a foundational early-Iran historical entry.