Skip to content

Cleaver

IntrusionSet · ATTACK:enterprise:G0003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0003",
  "title": "Cleaver",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063",
  "external_id": "G0003",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:46.390Z",
  "modified": "2026-07-31T18:48:08.140Z",
  "version": "1.3",
  "aliases": [
    "Cleaver",
    "Threat Group 2889",
    "TG-2889"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cleaver"
    },
    {
      "source_name": "Threat Group 2889"
    },
    {
      "source_name": "TG-2889"
    },
    {
      "source_name": "Cylance Cleaver",
      "url": "https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
    },
    {
      "source_name": "Dell Threat Group 2889",
      "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/"
    }
  ]
}

Explicit source assertions (9)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:S0056

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16fd44bf-405b-49c1-96d7-0cacb5d65e74

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c7b9a1b-e874-4881-884a-e3c3d1fd8aed

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1557.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e03e6e0-8b7b-4e93-a955-245561085aae

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cd8ef78-9d92-4e28-97ae-5bd6c698bfec

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--406e78ba-fc34-4be9-9dcc-323aad40d709

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:S0004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49957d89-7449-476a-b542-d7811a86c230

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dbfb31d-8ac7-44c5-ad9b-f22e07e95d7e

Cylance Cleaver

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a60c0123-95a3-4409-a60e-354e4237d6cb

Dell Threat Group 2889

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b08e3c96-25a7-412f-bbfb-63e010ef3891

Cylance Cleaver

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.