Loading threat actor…
Cleaver is an Iranian threat actor tracked since at least 2014 and associated with cyber espionage activity. Known aliases include TG-2889 and Threat Group 2889. The group has targeted organizations in aviation, energy, military, transportation, health care, and utilities, with victimology spanning China, France, Germany, India, Israel, Saudi Arabia, and the United States. Cleaver has also been identified among highly active APT entities in 2025. Cleaver is known for developing and using customized tooling and payloads rather than relying solely on commodity malware. Reported capabilities include tools for ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging. The group has also used publicly available offensive and administrative tools including PsExec, Mimikatz, and Windows Credential Editor. Operationally, Cleaver has demonstrated credential-access tradecraft, especially credential dumping from Windows environments, and has used social engineering through fake LinkedIn personas populated with realistic profile details and connections. Its observed behavior is consistent with reconnaissance, initial access via social engineering, credential theft, persistence through web shells and backdoors, and post-compromise collection activity. Available reporting most strongly supports espionage as the dominant motivation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as one of the most active APT groups of 2025 in NSFOCUS's annual report.
Known to perform credential dumping.
Listed in the detection annotations/MITRE attack groups metadata; no specific activity, targeting, or use of this Veeam exploitation is attributed in the content.
Listed in the detection annotation as a mapped threat actor associated with the analytic.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.