Cataloged
IdentityAlias: Threat Group 2889
Reviewed identity mapping approved on this date.
Cleaver
Also known as Threat Group 2889, TG-2889
Tracked as
G0003
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: TG-2889
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G0003
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
CleaverCanonical Name
TG-2889Alias
Threat Group 2889Alias
G0003Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...