MosesStaff
Also known as Moses Staff, Marigold Sandstorm, DEV-0500, VENGEFUL KITTEN
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1016 System Network Configuration DiscoveryT1021.002 SMB/Windows Admin SharesT1027.013 Encrypted/Encoded FileT1082 System Information DiscoveryT1087.001 Local AccountT1105 Ingress Tool TransferT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1553.002 Code SigningT1587.001 MalwareT1588.002 ToolT1686.003 Windows Host Firewall
Recent activity
No posts or advisories have named this actor recently.
References
- https://twitter.com/campuscodi/status/1450455259202166799
- https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/
- https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
- https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard
- https://attack.mitre.org/groups/G1009
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
- https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.