Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
🇮🇷 IR2 malware families

Cleaver

Also known asCleaverTG-2889Threat Group 2889

Cleaver is a threat actor tracked as G0003 and also referred to as tg_2889 and threat_group_2889. The provided content describes Cleaver as an Iranian threat group first tracked in 2014. It has targeted organizations in the aviation, energy, military, transportation, health care, and utilities sectors across China, France, Germany, India, Israel, Saudi Arabia, and the United States. Cleaver is described as using social engineering through fake LinkedIn profiles that included profile photos, details, and connections. The group has obtained and used open-source tools including PsExec, Windows Credential Editor, and Mimikatz, and has been known to dump credentials using Mimikatz and Windows Credential Editor. The content also states that Cleaver has created customized tools and payloads for ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Transportation
  • Energy
  • Military
  • Health Care Equipment & Services
  • Utilities

Where they target

Geographies tied to known operations.

  • 🇨🇳 China
  • 🇫🇷 France
  • 🇩🇪 Germany
  • 🇮🇳 India
  • 🇮🇱 Israel
  • 🇸🇦 Saudi Arabia
  • 🇺🇸 United States

Where they're from

Attributed origin per open-source reporting.

  • IR
MITRE ATT&CK

Tradecraft

12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

7 of 15 tactics18 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1598
Phishing for Information
TA0042
Resource Development
3 techniques
T1585
Establish Accounts
T1585.001×3
Social Media Accounts
T1587
Develop Capabilities
T1587.001×2
Malware
T1588
Obtain Capabilities
T1588.002×5
Tool
TA0001
Initial Access
1 technique
T1200
Hardware Additions
TA0002
Execution
2 techniques
T1059
Command and Scripting Interpreter
T1203
Exploitation for Client Execution
TA0006
Credential Access
2 techniques
T1003×4
OS Credential Dumping
T1003.001×4
LSASS Memory
T1557
Adversary-in-the-Middle
T1557.002×3
ARP Cache Poisoning
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.002
SMB/Windows Admin Shares
TA0009
Collection
1 technique
T1557
Adversary-in-the-Middle
T1557.002×3
ARP Cache Poisoning
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping12

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.