Cleaver
Also reported as TG-2889, Cutting Kitten, Operation Cleaver, Op Cleaver, Tarh Andishan and 10 other names. Linked to Iran by three sources.
Reports per quarter
Techniques in ATT&CK
Listed by ATT&CK
No report from the last two years names a technique ID.
CVEs named in reports
- CVE-2010-0232 KEV
- CVE-2010-4398 KEV
- CVE-2011-3402 KEV
- CVE-2012-0158 KEV ransomware
- CVE-2012-3152 KEV
- CVE-2014-1761 KEV
- CVE-2015-2360 KEV
- CVE-2015-5119 KEV
- CVE-2015-6585
- CVE-2019-11581 KEV
- CVE-2019-3396 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Cutting Kitten, TG-2889 - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cutting Kitten, TG-2889 - Threat Group Cards: A Threat Actor Encyclopedia
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Magic Hound, APT 35, Cobalt Illusion, Charming Kitten
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Magic Hound, APT 35, Cobalt Illusion, Charming Kitten
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation-Blockbuster-Report
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Lebanese-Cedar-APT
-
blogs.blackberry.com-Operation Cleaver The Notepad Files
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blogs.blackberry.com-Operation Cleaver The Notepad Files
-
Iranian Threat Actors- Preliminary Analysis
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Threat Actors- Preliminary Analysis
Show all 25 reports Show fewer
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iran_Cyber_Final_Full_v2
-
Anomali - Iran Country Profile relating to Security.pdf
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Anomali - Iran Country Profile relating to Security.pdf
-
The Curious Case of Mia Ash- Fake Persona Lures Middle Eastern Targets
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Curious Case of Mia Ash- Fake Persona Lures Middle Eastern Targets
-
us-16-Guarnieri-Anderson-Iran-And-The-Soft-War-For-Internet-Dominance-paper
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor us-16-Guarnieri-Anderson-Iran-And-The-Soft-War-For-Internet-Dominance-paper
-
Cyber warfare_ Iran opens a new front - FT
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber warfare_ Iran opens a new front - FT
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PowerPoint Presentation
-
Iran-based attackers use back door threats to spy on Middle Eastern targets
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Iran-based attackers use back door threats to spy on Middle Eastern targets
-
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Blockbuster
-
Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
-
Hacker Group Creates Network of Fake LinkedIn Profiles
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Hacker Group Creates Network of Fake LinkedIn Profiles
-
Hacker Group Creates Network of Fake LinkedIn Profiles
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hacker Group Creates Network of Fake LinkedIn Profiles
-
Operation Cleaver: The Notepad Files
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Cleaver: The Notepad Files
-
Cylance_Operation_Cleaver_Report
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cylance_Operation_Cleaver_Report
Newest first. Details opens the report in Explore.