Cleaver · APT / State-sponsored · RaqibCTI

Knowledge/Actors/CleaverCorpus

+ Request intel workspace

apt

Cleaver

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Operation CleaverThreat Group 2889TG-2889Tarh Andishan

Attribution

Iran — assessed state-sponsored (medium-high confidence)

Origin

Iran

First seen

2012

Last active

2015

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Saudi Arabia, UAE, Qatar, Kuwait

Sectors

Energy, aviation, military, transportation, critical infrastructure

MITRE ATT&CK

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Saudi Arabia, UAE, Qatar (Energy, aviation, military sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Related to

Void Manticore (Storm-0842)actorTechnique overlap
OilRig (APT34)actorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
2025 Cyber Threat Intelligence ReportreportORKL2025-06-24
2025 Global Threat ReportreportORKL2025-02-27
Botnet Command & Control Infrastructure ReportreportORKL2025-01-10
Down the Grayrabbit Hole – Exposing UNC3569 and its Modus OperandireportORKL2024-09-24
Botnet Command and Control Infrastructure Report January to June 2024

Overview Attribution² TTPs⁵ Indicators Reporting¹² Coverage

Reporting history

12 reports · 0 publishers

Third-party sources archived via ORKL — not RaqibCTI assessments. Reported since 2023-07-12.

C2025-06-24

2025 Cyber Threat Intelligence Report

📄 PDF 📃 text ↗ ORKL ↗ source

A2025-02-27

2025 Global Threat Report

📄 PDF 📃 text ↗ ORKL ↗ source

Useful?

report

ORKL2024-07-08

←Kinsing Demystified A Comprehensive Technical GuidereportORKL2024-05-03

←Chinese APT: A Master of Exploiting Edge DevicesreportORKL2024-04-12

←Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and EuropereportORKL2024-01-12

←Botnet Command and Control Infrastructure Report Q4 2023reportORKL2024-01-11

←2023 Adversary Infrastructure ReportreportORKL2024-01-08

←Botnet Command & Control Infrastructure Tracking ReportreportORKL2023-10-12

←Botnet Command & Control Infrastructure Report Q2 2023reportORKL2023-07-12

Uses

ARP Cache PoisoningtechniqueATT&CK mapping
TooltechniqueATT&CK mapping
LSASS MemorytechniqueATT&CK mapping
Social Media AccountstechniqueATT&CK mapping
MalwaretechniqueATT&CK mapping

B2025-01-10

Botnet Command & Control Infrastructure Report

📄 PDF 📃 text ↗ ORKL ↗ source

B2024-09-24

Down the Grayrabbit Hole – Exposing UNC3569 and its Modus Operandi

📄 PDF 📃 text ↗ ORKL ↗ source

B2024-07-08

Botnet Command and Control Infrastructure Report January to June 2024

📄 PDF 📃 text ↗ ORKL ↗ source

C2024-05-03

Kinsing Demystified A Comprehensive Technical Guide

📄 PDF 📃 text ↗ ORKL ↗ source

C2024-04-12

Chinese APT: A Master of Exploiting Edge Devices

📄 PDF 📃 text ↗ ORKL ↗ source

C2024-01-12

Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and Europe

📄 PDF 📃 text ↗ ORKL ↗ source

B2024-01-11

Botnet Command and Control Infrastructure Report Q4 2023

📄 PDF 📃 text ↗ ORKL ↗ source

A2024-01-08

2023 Adversary Infrastructure Report

📄 PDF 📃 text ↗ ORKL ↗ source

B2023-10-12

Botnet Command & Control Infrastructure Tracking Report

📄 PDF 📃 text ↗ ORKL ↗ source

B2023-07-12

Botnet Command & Control Infrastructure Report Q2 2023

📄 PDF 📃 text ↗ ORKL ↗ source

Sources

01Cleaver (G0003) — MITRE ATT&CK, 2025-04 ↗02Operation Cleaver Report — Cylance, 2014-12 ↗03Iranian hackers targeted airlines, energy firms — Operation Cleaver — Reuters, 2014-12 ↗srcMENA Threat Actor Tracker reference ↗

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

ActorOilRig (APT34)
ActorAPT33
ActorMuddyWater
ORKLInvestigating Iranian Intrusion into Strategic Middle East Critical Infrastructure ↗
ActorFlying Kitten
ActorFlame / Flamer