[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJlA1H74aSSFxon0VWX2mR_a3xZzpftOWgf6KX-UUEks":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":16,"country":17,"suspected_sponsor":18,"target_industries":19,"target_countries":22,"incident_types":38,"references":40,"techniques":56,"technique_count":67,"created_at":68,"seoMetadata":69,"schemaOrg":73},"Cleaver","cleaver",[9,10,11,12,13,14,15],"Operation Cleaver","Op Cleaver","Tarh Andishan","Alibaba","TG-2889","Cobalt Gypsy","G0003","A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.","IR","Iran (Islamic Republic of)",[20,21],"Private sector","Government",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"Canada","France","Israel","Mexico","Saudi Arabia","China","Germany","United States","Pakistan","South Korea","United Kingdom","India","Kuwait","Qatar","Turkey",[39],"Espionage",[41,42,43,44,45,46,47,48,49,50,51,52,53,54,55],"https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthe-curious-case-of-mia-ash","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Foperation-cleaver","http:\u002F\u002Fwww.secureworks.com\u002Fcyber-threat-intelligence\u002Fthreats\u002Fsuspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles\u002F","https:\u002F\u002Fwww.trendmicro.com\u002Fvinfo\u002Fus\u002Fsecurity\u002Fnews\u002Fcyber-attacks\u002Foperation-woolen-goldfish-when-kittens-go-phishing","https:\u002F\u002Fwww.secureworks.com\u002Fblog\u002Firanian-pupyrat-bites-middle-eastern-organizations","https:\u002F\u002Fblogs.microsoft.com\u002Fon-the-issues\u002F2019\u002F03\u002F27\u002Fnew-steps-to-protect-customers-from-hacking\u002F","https:\u002F\u002Fwww.trendmicro.de\u002Fcloud-content\u002Fus\u002Fpdfs\u002Fsecurity-intelligence\u002Fwhite-papers\u002Fwp-the-spy-kittens-are-back.pdf","https:\u002F\u002Fblog.checkpoint.com\u002Fwp-content\u002Fuploads\u002F2015\u002F11\u002Frocket-kitten-report.pdf","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0003\u002F","https:\u002F\u002Fxorl.wordpress.com\u002F2021\u002F05\u002F06\u002Firan-cyber-operations-groups\u002F","https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fsuspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles","https:\u002F\u002Fknow.netenrich.com\u002Fthreatintel\u002Fthreat_actor\u002FCutting%20Kitten","https:\u002F\u002Fwww.cfr.org\u002Fcyber-operations\u002Foperation-cleaver","https:\u002F\u002Fsecurityaffairs.co\u002Fwordpress\u002F33682\u002Fcyber-crime\u002Fali-baba-apt-middle-east.html","https:\u002F\u002Fscadahacker.com\u002Flibrary\u002FDocuments\u002FCyber_Events\u002FCylance%20-%20Operation%20Cleaver%20Report.pdf",[57,58,59,60,61,62,63,64,65,66],"T1557","T1557.002","T1587","T1587.001","T1585","T1585.001","T1588","T1588.002","T1003","T1003.001",10,"2023-08-09T17:25:09.409843+00:00",{"title":70,"metaDescription":71,"keywords":72},"Cleaver Threat Actor Profile | Precursor Intelligence","A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and privat...","Cleaver, Operation Cleaver, Op Cleaver, Tarh Andishan, Alibaba, TG-2889, Cobalt Gypsy, G0003, threat actor, APT, cyber threat, threat intelligence, Private sector, Government, Iran (Islamic Republic of), IR",{"@context":74,"@type":75,"name":6,"alternateName":76,"description":16,"url":77,"mainEntityOfPage":78,"location":80},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fcleaver",{"@type":79,"@id":77},"WebPage",{"@type":81,"name":17},"Country"]