THREATOPS Actor Dossier
LIVE ← Dashboard

Cleaver

G00031 reports
aliases · Cleaver · Threat Group 2889 · TG-2889
Export dossier:
1
Reports
0
Techniques
0
Tactics
1
Countries
n/a
Hunt coverage
3
Aliases

Analyst assessment — key judgments

  • Primary targeting: US.
  • Tooling observed: anubis.
  • Activity declining: 0 report(s) in last 30d vs 1 prior (-100%).
  • Assessment confidence: n/a.

Activity & trend

DecliningLast 30d: 0 vs 1 prior (-100%)· first reported 2026-08-10 · last 2026-08-10
0
7d
0
30d
1
90d
1
All
0.1
Rpts/wk
Reporting timeline · 12 months

Movement — last 30 days

Targeting lost
US

Overview

Analyst triage
Intelligence summary

Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)

Top co-occurring indicators
    Aliases & naming
      Targeting · countries
        Targeting · named victims

          ATT&CK technique matrix

          Coverage vs hunt library:
          —
          Hunt-coverage gaps — prioritized

            Top techniques by observation
            • No ATT&CK techniques associated yet.

            Threat catalogue · engineering roadmap0

            Flagged detection-engineering queue

            Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

              No techniques queued yet — flag a gap above to add it here.

              Infrastructure

              IOC type mix
              Tooling / malware families
                Tracked infrastructure

                Relationships

                Related actors (behavioral cluster)
                  Attributed malware
                  Campaigns
                  No behavioral cluster, attributed malware, or campaigns recorded for this actor yet.

                  Activity

                  30-day mention timeline
                  Recent reporting
                  TitleSourceSeverityCollected