Cleaver

Origin🇮🇷 Irã

Techniques (MITRE ATT&CK)5

SourceMITRE ATT&CK

State sponsor: Iran (Islamic Republic of)Attribution confidence: 50%Target categories: Private sector, Government

Targeted regions: Canada · France · Israel · Mexico · Saudi Arabia · China · Germany · United States · Pakistan · South Korea +5

Also known as:AlibabaCobalt GypsyG0003Op CleaverOperation CleaverTG-2889Tarh AndishanThreat Group 2889

Vexday analysis

Cleaver é um grupo de ameaça persistente avançada (APT) atribuído a atores iranianos, responsável pela atividade rastreada como Operação Cleaver. Evidências circunstanciais robustas sugerem que o grupo está vinculado ao Threat Group 2889 (TG-2889). O grupo é catalogado no MITRE ATT&CK como G0003, com cinco técnicas documentadas associadas à sua atividade.

Techniques (MITRE ATT&CK) 5

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Social Media Accounts Malware Tool

Credential access

LSASS Memory ARP Cache Poisoning

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 3

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha1_hashc5ec7e2ad924e832e49fbac9d0c82719b570e080MimiKatzthreatfox

md5_hash77c96f339974b65ae435313a8fcc3b35MimiKatzthreatfox

sha256_hash889cc3e793cb39889c7acc8e73a84973e9a08fcd69451f7b546509c74ffdda90MimiKatzthreatfox

References

Cleaver uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →