Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · MosesStaff · Unknown · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

MosesStaff

  • Moses Staff
  • Marigold Sandstorm
  • DEV-0500
  • VENGEFUL KITTEN

MITRE G1009 ↗

MosesStaff — ATT&CK roseMO

attack rose · 12 techniques across 8 tactics

Analyst brief

misp-galaxy + mitre-attack

Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

12 techniques · 8 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Persistence

    1 technique

  4. Stealth

    1 technique

  5. Defense impairment

    2 techniques

  6. Discovery

    3 techniques

  7. Lateral movement

    1 technique

  8. Command and control

    1 technique

select a technique

Arsenal

3 malware · 1 tools
Malware
Malware · 3ATT&CK
PyDCryptS1032 ↗
DCSrvS1033 ↗
StrifeWaterS1034 ↗
Tools
Tools · 1ATT&CK
PsExecS0029 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022Guard Your Drive from DriveGuard: Moses Staff Campaigns Against Israeli Organizations Span Several Monthsfortinet ↗

Take it with you

keyless · no signup

References

7 sources
  1. 1.twitter.com/campuscodi/status/1450455259202166799
  2. 2.research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies
  3. 3.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-…
  4. 4.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard
  5. 5.attack.mitre.org/groups/G1009
  6. 6.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-…
  7. 7.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…

Track MosesStaff on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.