Cleaver
No sourced public emblem in this profile.
reference profile · reported nexus: IR (not nationality)
A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.
Source-reported aliases: Operation Cleaver, Op Cleaver, Tarh Andishan, Alibaba, TG-2889, Cobalt Gypsy, G0003. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Canada · 
France · 
Israel · 
Mexico · 
Saudi Arabia · 
China · 
Germany · 
United States of America · 
Pakistan · 
South Korea · 
United Kingdom · 
India · 
Kuwait · 
Qatar · 
Türkiye
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.secureworks.com/research/the-curious-case-of-mia-ash
https://www.cfr.org/interactive/cyber-operations/operation-cleaver
https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations
https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/
https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
https://attack.mitre.org/groups/G0003/
https://xorl.wordpress.com/2021/05/06/iran-cyber-operations-groups/
https://know.netenrich.com/threatintel/threat_actor/Cutting%20Kitten
https://www.cfr.org/cyber-operations/operation-cleaver
https://securityaffairs.co/wordpress/33682/cyber-crime/ali-baba-apt-middle-east.html