Watch Floor
State-backedIran

Cleaver

Also known as Operation Cleaver, Op Cleaver, Tarh Andishan, Alibaba, TG-2889, Cobalt Gypsy, G0003

4mentions, 7 days
25mentions, 30 days
Nov 4, 2026last mentioned

A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.

Targets: Private sector, Government, Canada, France, Israel, Mexico, Saudi Arabia, China, Germany, United States, Pakistan, South Korea, United Kingdom, India, Kuwait

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.