Cleaver__2014__Cylance_Operation_Cleaver_Report.pdf

Operation Cleaver is a Cylance-authored APT report attributing a long-running, Iranian-sponsored campaign (Tarh Andishan) that has targeted more than 50 victims across government and critical infrastructure sectors globally. The document provides technical analysis of multiple custom and repurposed malware families (TinyZBot, PVZ, Net Crawler, zhCat, etc.), detailed TTPs (SQL injection, spear-phishing, credential dumping, lateral movement, SOAP/HTTP C2), attribution evidence (Iranian registrant info, IP/netblocks, code artifacts), and a large set of IOCs (domains, IPs, file hashes, mutexes, YARA rules) plus mitigation guidance and contact information for incident response.