MosesStaff

G1009IR0 reports from 0 vendors

Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.

Vendor aliases (4)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	Moses Staff
OSINT	Marigold Sandstorm
OSINT	DEV-0500
OSINT	VENGEFUL KITTEN

MITRE ATT&CK techniques (12)

T1016 T1021.002 T1027.013 T1082 T1087.001 T1105 T1190 T1505.003 T1553.002 T1587.001 T1588.002 T1686.003

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names MosesStaff, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to MosesStaff. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (7)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G1009
learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
research.checkpoint.comhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/
cybereason.comhttps://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
twitter.comhttps://twitter.com/campuscodi/status/1450455259202166799
cybereason.comhttps://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
fortinet.comhttps://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard