Cleaver
Operation CleaverOp CleaverTarh AndishanAlibabaTG-2889Cobalt GypsyG0003Threat Group 2889
A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with… Source: MISP
Attributed country: IR according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 11 Nov 2026 · last seen on 11 Nov 2026
News
- Hackers use AntiFox AI agents in AWS credential-theft attacksBleepingComputer · 11 Nov 2026
MITRE ATT&CK techniques
Resource Development
Credential Access
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗