Threat Investigation
Request a demo
State-sponsored

Cleaver

Cleaver is classified as state-sponsored.

Malware families
38
Suspected state sponsor
Iran
Also known as
7

A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.

The group is suspected of operating with the support of Iran.

The group is associated with 38 malware families.

Also known as: Operation Cleaver, Op Cleaver, Tarh Andishan, Alibaba, TG-2889, Cobalt Gypsy, G0003

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Cleaver · Threat actors · Dark Radar