Moses Staff

Executive Summary

Moses Staff, also known as DEV-0500, Marigold Sandstorm, and VENGEFUL KITTEN, is a suspected Iranian threat group targeting Israeli companies since September 2021. The group's primary motivation appears to be politically driven, focusing on causing damage by leaking stolen sensitive data and encrypting victim networks without demanding ransom. Moses Staff has expanded its scope to target various sectors globally, including government, finance, travel, energy, manufacturing, and utility companies in countries such as Italy, India, Germany, Chile, Turkey, the UAE, and the US.

Goals & Targeting

Moses Staff appears to operate with strategic objectives centered on disrupting businesses and causing reputational harm through data breaches. The group's targeting profile focuses on sectors that handle sensitive information, such as government, finance, travel, energy, manufacturing, and utilities. Their geographic reach includes Israel and countries like Italy, India, Germany, Chile, Turkey, the UAE, and the US, suggesting a global rather than region-specific focus. Typical victims are organizations with significant digital assets and potential for public exposure of sensitive data.

Moses Staff is a cyber threat group suspected to be of Iranian origin. The group has demonstrated a focus on disrupting Israeli companies through data breaches and network encryption. Unlike many ransomware groups, Moses Staff does not demand ransom, instead aiming to inflict reputational and operational damage by publicly leaking stolen data. Security researchers have identified the group's campaign patterns as politically motivated, with a particular interest in critical infrastructure and sensitive industries. The group's operations extend beyond Israel, targeting organizations in various sectors across multiple countries. Their tactics include malware deployment, exploit of public-facing applications, and use of web shells, indicating a moderate level of technical sophistication.

Key Capabilities

• Malware development and deployment
• Network encryption/locker functionality
• Data exfiltration
• Public data leak capability

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Moses Staff has conducted campaigns since at least September 2021, primarily targeting Israeli companies but also expanding globally. The group's operational tempo suggests persistence and adaptability, with a focus on breaching critical systems and causing maximum disruption. Their use of malware and encryption tools indicates moderate technical expertise. Notable operations include attacks against government and financial institutions in the Middle East and Western countries.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• Malware deployment targeting network infrastructure
• Encrypted data exfiltration channels
• Use of web shells for lateral movement

Recommended Actions

• Implement multi-layered email filtering to detect phishing attempts.
• Monitor for异常 network encryption activities and implement robust IDS/IPS solutions.
• Regularly patch and secure public-facing applications to mitigate T1190 vulnerabilities.
• Conduct regular data backups and ensure they are isolated from the main network.
• Enhance privilege management to prevent unauthorized access to sensitive systems.

Suggested Tags