Cleaver
Cleaver is an Iran-attributed cybercrime syndicate with an espionage motive, tracked by Brandefense. It targets 13 sectors, including Government and Technology, in 28 countries, including the United States and the United Kingdom. It uses 5 MITRE ATT&CK techniques and exploits 4 known CVEs.
Also known as
- Threat Group 2889
- TG-2889
- Cutting Kitten
- G0003
- Operation “Cleaver”
- Origin
- Iran
- Techniques
- 5
- Exploited CVEs
- 4
- First seen
- Jan 1, 2012
- Last seen
- Jan 1, 2015
- Record updated
Who They Target.
Sectors · 13
Countries · 28
About Cleaver.
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889).
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.