Actors Insights|Latest update04/07/2026

TG-2889

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran

TG-2889 is Trend Micro's designation for campaign activity attributed to the Rocket Kitten cluster, documented in 2014-2015. Trend Micro tracked TG-2889 conducting targeted spear phishing operations against defense contractors, academic researchers, and government officials in Israel, Europe, and the Middle East, using fake LinkedIn profiles and job-offer lures to deliver credential harvesting pages. The group's targeting of defense industrial base and academic targets aligns with the broader Rocket Kitten cluster's documented focus on Israeli and NATO-affiliated personnel of intelligence interest to Iran.

First Seen:Dec 2014
Last Seen:Oct 2015
Indexed Reports:1
Public IOCs:3
Cluster: Rocket KittenMitre: CleaverMisp: Cleaver
also known as:
Operation CleaverOp CleaverTarh Andishan (Cylance)AlibabaTG-2889 (SecureWorks)COBALT GYPSY (SecureWorks)G0003 (Mitre)Threat Group 2889

Targeted Regions

Algeria
DZ
Algeria
Algeria
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Bahrain
BH
Bahrain
Bahrain
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Canada
CA
Canada
Canada
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Egypt
EG
Egypt
Egypt
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
India
IN
India
India
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Iran
IR
Iran
Iran
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Israel
IL
Israel
Israel
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Jordan
JO
Jordan
Jordan
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Kuwait
KW
Kuwait
Kuwait
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Qatar
QA
Qatar
Qatar
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Sudan
SD
Sudan
Sudan
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
United Kingdom
GB
United Kingdom
United Kingdom
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
United States
US
United States
United States
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Dec 2014 ~ Oct 2015
Jan 2014Jun 2026

Targeted Sectors

DefenseGovernment Agencies and ServicesManufacturingAerospaceTelecommunication

Recent Indexed Reports

  1. Public
    Iran-Based TG-2889 Uses Fake LinkedIn Network to Target Middle East Telecom and Defense

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.