Cyber threats / Threat actors

Cleaver

IR Suspected sponsor: Iran · ATT&CK G0003
3
APAC targets
5
Techniques
0
Incidents
0
News · 30d
Profile
Also known as: Alibaba, APT34, COBALT GYPSY, Crambus, Earth Simnavaz, EUROPIUM, Evasive Serpens, G0003, Hazel Sandstorm, Helix Kitten, IRN2, ITG13, OilRig, Op Cleaver, Operation Cleaver, TA452, Tarh Andishan, TG-2889, Threat Group 2889

A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.

ATT&CK techniques · 5
Resource Development
Credential Access
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
Targets
Elsewhere: Canada, Germany, France, United Kingdom, Israel, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, Türkiye, United States
Sectors: Academia - University, Defense, Energy, Government, Government, Administration, Private sector, Technology
Relevance to the EU
EU relevance: High
Targets EU member states (Germany, France) as well as 3 Asia-Pacific countries
16 EU cooperation projects in the Asia-Pacific countries this actor targets:
Trade & Investment
5
Research & Innovation
2
Infrastructure & Transport
2
Digital & ICT
2
Development Cooperation
2
Peace & Security
1
Education & Skills
1
Climate & Environment
1
Threats to the EU →
References
Sources: MISP, MITRE