Moses Staff

Moses Staff is an Iran-linked threat actor best known for disruptive intrusions against Israeli organizations beginning in 2021. The group has also been tracked as DEV-0500, DEV-500, Marigold Sandstorm, MosesStaff, and Vengeful Kitten. Reporting has tied the operation to Iranian state-directed activity, and later overlap findings connected Moses Staff infrastructure and administration with other Iranian cyber personas. Moses Staff is notable for combining data theft, destructive or pseudo-ransomware behavior, and public leaking of stolen information. Unlike conventional financially motivated ransomware groups, it has been characterized by attacks intended to damage victims and publicize stolen data rather than reliably collect ransom payments. Victimology has centered heavily on Israel-based organizations, with additional targeting reported in other countries. Operationally, Moses Staff has exploited public-facing applications for initial access and used web shells, including IIS-related persistence mechanisms. The group has conducted host and network discovery, collecting details such as machine names, operating system architecture, domain information, and other environment data from compromised systems. It has used custom tooling including StrifeWater, a remote access trojan associated with early-stage access and remote command execution, alongside other malware used to support exfiltration and disruptive actions. A hallmark of Moses Staff tradecraft is abuse of the legitimate DiskCryptor utility and its signed drivers to encrypt systems or volumes while blending with legitimate software. The group has also used obfuscated web shells and other defense-evasion measures. Its activity profile aligns with espionage-enabled disruption and destructive operations directed primarily at Israeli targets, with data theft and publication serving coercive and psychological effects rather than straightforward monetization.