2 malware families

Cleaver

Also known asCleaverTG-2889Threat Group 2889

Cleaver is a tracked threat actor also referenced as tg_2889 and threat_group_2889. The content identifies Cleaver as G0003 and associates it with credential dumping and use of open-source tooling. Specifically, Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor, and has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz. The content also states that Cleaver has created customized tools and payloads for ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging. In addition, Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections. The content maps Cleaver to ATT&CK technique T1588.002 (Tool) and T1003.001 (LSASS Memory).

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

6 of 15 tactics17 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0042

Resource Development

3 techniques

T1585

Establish Accounts

T1585.001×3

Social Media Accounts

T1587

Develop Capabilities

T1587.001×2

Malware

T1588

Obtain Capabilities

T1588.002×5

Tool

TA0001

Initial Access

1 technique

T1200

Hardware Additions

TA0002

Execution

2 techniques

T1059

Command and Scripting Interpreter

T1203

Exploitation for Client Execution

TA0006

Credential Access

2 techniques

T1003×4

OS Credential Dumping

T1003.001×4

LSASS Memory

T1557

Adversary-in-the-Middle

T1557.002×3

ARP Cache Poisoning

TA0008

Lateral Movement

1 technique

T1021

Remote Services

T1021.002

SMB/Windows Admin Shares

TA0009

Collection

1 technique

T1557

Adversary-in-the-Middle

T1557.002×3

ARP Cache Poisoning

ARSENAL

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

MimikatzAPT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.2May 26, 2026

Windows Credential EditorAPT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.2May 26, 2026

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

slideshareNews

May 21, 2026

Hunting for Credentials Dumping in Windows Environment | PDF

Known to perform credential dumping.

splunk researchNews

Feb 25, 2026

Detection: Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity | Splunk Security Content

Listed in the detection annotations/MITRE attack groups metadata; no specific activity, targeting, or use of this Veeam exploitation is attributed in the content.

splunk researchNews

Feb 25, 2026

Detection: Cisco Secure Firewall - Possibly Compromised Host | Splunk Security Content

Listed in the detection annotation as a mapped threat actor associated with the analytic.

splunk researchNews

Feb 25, 2026

Detection: Creation of lsass Dump with Taskmgr | Splunk Security Content

Referenced as a threat actor associated with LSASS memory credential access / credential dumping activity.

+17 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping11

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.