IRIran (Islamic Republic of)confidence: 50G0003
CleaverCleaver
Also known as: Operation Cleaver · Op Cleaver · Tarh Andishan · Alibaba · TG-2889 · Cobalt Gypsy · G0003 · Cleaver
Origin
IR
Known aliases
8
Target sectors
2
Attribution
State-sponsored
Profile
A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.
Aliases· 8
Operation CleaverOp CleaverTarh AndishanAlibabaTG-2889Cobalt GypsyCleaver
Target sectors· 2
Private sectorGovernment
Known victims· 15
- Canada
- France
- Israel
- Mexico
- Saudi Arabia
- China
- Germany
- United States
- Pakistan
- South Korea
- United Kingdom
- India
MITRE ATT&CK Group crosswalk
References
- https://www.secureworks.com/research/the-curious-case-of-mia-ash
- https://www.cfr.org/interactive/cyber-operations/operation-cleaver
- http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-goldfish-when-kittens-go-phishing
- https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations
- https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/
- https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-spy-kittens-are-back.pdf
- https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.