{
    "type": "bundle",
    "id": "bundle--dd0362fe-39ff-4025-9dbd-33191b2cc735",
    "spec_version": "2.0",
    "objects": [
        {
            "type": "intrusion-set",
            "id": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "name": "Cleaver",
            "description": "[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0003",
                    "external_id": "G0003"
                },
                {
                    "source_name": "Cleaver",
                    "description": "(Citation: Cylance Cleaver)"
                },
                {
                    "source_name": "Threat Group 2889",
                    "description": "(Citation: Dell Threat Group 2889)"
                },
                {
                    "source_name": "TG-2889",
                    "description": "(Citation: Dell Threat Group 2889)"
                },
                {
                    "source_name": "Cylance Cleaver",
                    "description": "Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.",
                    "url": "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
                },
                {
                    "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/",
                    "description": "Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016.",
                    "source_name": "Dell Threat Group 2889"
                }
            ],
            "aliases": [
                "Cleaver",
                "Threat Group 2889",
                "TG-2889"
            ],
            "modified": "2020-10-15T16:59:26.732Z",
            "created": "2017-05-31T21:31:46.390Z",
            "x_mitre_version": "1.2"
        }
    ]
}