Threat feed IOCs (200)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Cleaver. Each row shows why it was linked and where it came from.

Public research & publications (17)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• secureworks.comhttp://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/
• attack.mitre.orghttps://attack.mitre.org/groups/G0003
• cylance.comhttps://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
• secureworks.comhttps://www.secureworks.com/research/the-curious-case-of-mia-ash
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/operation-cleaver
• trendmicro.comhttps://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-goldfish-when-kittens-go-phishing
• secureworks.comhttps://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations
• blogs.microsoft.comhttps://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/
• trendmicro.dehttps://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-spy-kittens-are-back.pdf
• blog.checkpoint.comhttps://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
• attack.mitre.orghttps://attack.mitre.org/groups/G0003/
• xorl.wordpress.comhttps://xorl.wordpress.com/2021/05/06/iran-cyber-operations-groups/
• secureworks.comhttps://www.secureworks.com/research/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles
• know.netenrich.comhttps://know.netenrich.com/threatintel/threat_actor/Cutting%20Kitten
• cfr.orghttps://www.cfr.org/cyber-operations/operation-cleaver
• securityaffairs.cohttps://securityaffairs.co/wordpress/33682/cyber-crime/ali-baba-apt-middle-east.html
• scadahacker.comhttps://scadahacker.com/library/Documents/Cyber_Events/Cylance%20-%20Operation%20Cleaver%20Report.pdf