Clever Kitten, also identified as Group 41, is an Iranian nation-state threat group that first emerged by mid-January 2014 and was prominently involved in "Operation Cleaver" by December 2014. The group's primary motivation is information theft and espionage, targeting global entities considered strategically important to countries perceived as adversaries to Iranian interests. A distinguishing characteristic of Clever Kitten is its pronounced affinity for PHP server-side attacks to gain initial access, a method that sets it apart from many other targeted attackers who frequently prioritize social engineering against specific individuals. Historically, the group has focused its intelligence-gathering efforts on government, energy, and aviation sectors.