Moses Staff

Summary

Suspected Iranian group (MITRE G1009; Microsoft Marigold Sandstorm, formerly DEV-0500) that since September 2021 has broken into Israeli companies, leaked their data and encrypted their networks with no ransom demand — its stated aim is damage, not money. It exploits public-facing servers such as Exchange, uses the PyDCrypt and DCSrv tools (DCSrv built on DiskCryptor's signed driver) and the StrifeWater RAT, which it removes before encryption. Victims outside Israel include organisations in the UAE, Italy, India, Germany, Chile, Turkey and the US. From November 2022 the Abraham's Ax persona leaked material on Saudi government ministries; Secureworks found shared iconography, video and infrastructure and judges it more likely run by the same operator.

Attribution

No service publicly named

Hedged, circumstantial or press-only reporting; not established.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Suspected Iranian

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 3

Infrastructure patterns

• Runs its own hack-and-leak website, moses-staff[.]se, for the stolen data it publishes (Check Point, 2021)

Reporting and advisories 4

• Check Point Research
  Hack-and-leak with no-ransom encryption against Israeli organisations (PyDCrypt / DCSrv)
• CSO Online, reporting Cybereason
  Iranian APT group uses previously undocumented Trojan for destructive access to organizations (3 Feb 2022)
• Secureworks CTU
  Abraham's Ax likely linked to Moses Staff (Jan 2023)
• MITRE ATT&CK
  Moses Staff (G1009) group profile