Mosesstaff
InactiveMoses Staff · DEV-0500 · Marigold Sandstorm also known as
Total victims
0
This month
0
Active
—
DayBreach AI intelligence
How it operates
Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.
MITRE ATT&CK profile
G1009
[Moses Staff](https://attack.mitre.org/groups/G1009) is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. [Moses Staff](https://attack.mitre.org/groups/G1009) openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Citation: Checkpoint MosesStaff Nov 2021) Security researchers assess [Moses Staff](https://attack.mitre.org/groups/G1009) is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.(Citation: Cybereason StrifeWater Feb 2022)
Techniques it uses
SMB/Windows Admin Shares
T1016System Network Configuration Discovery
T1087.001Local Account
T1686.003Windows Host Firewall
T1082System Information Discovery
T1588.002Tool
T1505.003Web Shell
T1587.001Malware
T1553.002Code Signing
T1027.013Encrypted/Encoded File
T1105Ingress Tool Transfer
T1190Exploit Public-Facing Application
Associated malware and tools