Cleaver
- ID
- G0003
- Associated names
- Threat Group 2889, TG-2889
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. [1] Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). [2]
Techniques used (5)
- T1003.001 LSASS Memory
- T1557.002 ARP Cache Poisoning
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1588.002 Tool