Forensia CTI Core

Profile

Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).

MITRE ATT&CK ↗

Techniques

5 ATT&CK techniques attributed to this actor.

T1003.001 LSASS Memory T1557.002 ARP Cache Poisoning T1585.001 Social Media Accounts T1587.001 Malware T1588.002 Tool

Software

4 malware/tools attributed to this actor.

MimikatzTinyZBotPsExecNet Crawler

Related corpus activity

902 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Cleaver.

Indicator	Type	Family	Sev	Src
cve-2021-27076	cve	—	85	1
cve-2026-4368	cve	ransomware	85	1
59a260716d05c20229c6a46fe0a2fb5b80fa30c9c73a850222d9d3454426a60a	sha256	ransomware	80	1
185633e5dbe9235fc7e6a1ccb8631650afefd8f7da88c5c07d9b99ea38159822	sha256	—	80	1
cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3	sha256	—	80	2
4b7301f02b8312ae6de614981f325dbbabee32166630618fdff74615d9a487ba	sha256	ransomware	80	1
186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da	sha256	ransomware	80	1
78945c844fc23dd3446cf17987edeeb6cc21986820c92df82a126af24a5a38d1	hash	—	80	2
6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23	sha256	ransomware	80	1
33d887ca2e57fa03fc807dfba5376bf96718ee88f56e90d95ee4896a2c019bd0	sha256	—	80	1
00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c	sha256	—	80	2
cf64c7e2e3897ae5fce3d5414e3d1d27	hash	—	80	2
5aa7afd790481ad98357636fa4d9927ae01111409c8d7ce69998d2485c1d5e6f	sha256	—	80	1
dfa9c6adac98311d0f62e0eeecb947d92f7bda41ddf4ce9a6f9e20af7990422d	sha256	—	80	1
f6e4b09ef788adef3f65fd2b99da8f5be5391be29471676dc07040a56c8fdfab	hash	—	80	2
4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384	sha256	—	80	2
9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472	sha256	—	80	2
a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2	sha256	ransomware	80	1
18b8e6762afd29a09becae283083c74a19fc09db1f2c3412c42f1b0178bc122a	sha256	ransomware	80	1
d89bb4b23a67814ef511e4e9dda7ad36fa519a322fa7c25ea451c7dd7ef61e54	hash	—	80	2
dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b	sha256	—	80	2
a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331	sha256	ransomware	80	1
41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2	hash	—	80	2
04ccc8f9f5e343f94ad9f41f08439b545d4b8486	hash	—	80	2
b5b603ff57142a454c3b0fb12eb8a4eb	hash	—	80	2
c333a821f1764abe2aed2c1ab27d2349f64e4264	hash	—	80	2
6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c	sha256	—	80	1
f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1	sha256	—	80	2
95cda8431419f77407484ab72dc1e356421dcd801eccabe8869f77ee0eb58eb2	sha256	—	80	1
415b253a81e67c8c860a97c73edc9017ce732b3c025d943d3b1a445b4ac82822	sha256	—	80	1

Showing the top 30 by severity of 902.