MosesStaffThreat actor
- dev-0500
- marigold sandstorm
- Moses Staff
- vengeful kitten
Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1036Masquerading
“Some hacktivists try to generate hype by posting data from past attacks and masquerading them as recent ones in order to attract attention”
- T1505.003Web Shell
“Furthermore, CMS access can be a starting point to infiltrate the web server, often through the uploading of web shells via the compromised CMS.”
What the reports say
1 report, newest first · the exact sentence from each-
Analyzing cyber activity surrounding the conflict in the Middle East“…at the material claimed to have been stolen in a recent attack was in fact the same data that was exfiltrated by the ransomware group Moses Staff in 2022 and uploaded onto their website (Figure 3).”
Thanks — we review every report.