Cleaver

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: Threat Group 2889, TG-2889

CyberIRN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeSuspected state-linked cyber threat group

Alternative designationsThreat Group 2889, TG-2889

ProliferationOrigin country only

MITRE ATT&CK IDG0003High^[1]

Capabilities

ATT&CK techniques used5ATT&CK v20.1High^[1]

Malware and toolsMimikatz, Net Crawler, PsExec, TinyZBot4 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorAttributed to Iranian actorsMed^[1]

Notes

Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Iran

Sources

Cleaver, Group G0003, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0003)