Threadlinqs IntelligenceStart free

Threat actorIran / North Korea (Cleaver, Lazarus); TA505 is non-state financially motivatedTracked since 2026-07

Cleaver

Also known as:TA505Lazarus Group

As of 2026-09-09, Cleaver is a Iran / North Korea (Cleaver, Lazarus); TA505 is non-state financially motivated-nexus threat actor tracked by Threadlinqs Intelligence across 3 threats spanning threat intel, apt. Also known as TA505, Lazarus Group. ATT&CK coverage spans 44 techniques across 15 tactics in 3 of 3 tracked threats. Most-observed techniques: AML.T0008 (Acquire Infrastructure), AML.T0024.002 (Exfiltration via AI Inference API: Extract AI Model), AML.T0040 (AI Model Inference API Access).

Tracked threats
31 critical · 1 high · 1 medium
First seen
2026-07-20
Last seen
2026-09-09
ATT&CK techniques
44across 3 of 3 threats
Related CVEs
0None referenced
Attribution
Iran / North Korea (Cleaver, Lazarus); TA505 is non-state financially motivatedNation or origin
Nation: Iran / North Korea (Cleaver, Lazarus); TA505 is non-state financially motivated · 3 tracked threat(s) · Categories: THREAT_INTEL, APT

Activity timeline

Cleaver appears in 3 tracked threats between and ; the busiest month was 2026-09 with 2 reports.

ATT&CK techniques observed

44 techniques observed across 3 of 3 tracked threats · Resource Development (6), Stealth (formerly Defense Evasion) (6), Exfiltration (5), Command and Control (4), Discovery (4), Initial Access (4)
  • AML.T0008 Acquire Infrastructure — Resource Developmentobserved in 2 of 3 tracked threats
  • AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model — Exfiltrationobserved in 2 of 3 tracked threats
  • AML.T0040 AI Model Inference API Access — AI Model Access (ATLAS)observed in 2 of 3 tracked threats
  • AML.T0042 Verify Attack — AI Attack Staging (ATLAS)observed in 2 of 3 tracked threats
  • AML.T0051 LLM Prompt Injection — Executionobserved in 2 of 3 tracked threats
  • AML.T0054 LLM Jailbreak — Stealth (formerly Defense Evasion)observed in 2 of 3 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 2 of 3 tracked threats
  • T1048 Exfiltration Over Alternative Protocol — Exfiltrationobserved in 2 of 3 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 2 of 3 tracked threats
  • T1583.003 Virtual Private Server — Resource Developmentobserved in 2 of 3 tracked threats
  • AML.T0024 Exfiltration via AI Inference API — Exfiltrationobserved in 1 of 3 tracked threats
  • AML.T0048 External Harms — Impactobserved in 1 of 3 tracked threats
  • AML.T0048.004 External Harms: AI Intellectual Property Theft — Impactobserved in 1 of 3 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 1 of 3 tracked threats
  • T1005 Data from Local System — Collectionobserved in 1 of 3 tracked threats

Tracked threats