GINC Technology
GINC-APT-0017 · Criminal

Moses Staff

Also Marigold Sandstorm, MosesStaff, Abraham's Ax, abrahams-ax, Abrahams_Ax, Cobalt Sapling and 6 other names.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Iran(high confidence)
Motivation
Sabotage and destruction
Seen
2021–2026
Status
Active
ATT&CK
G1009 · 12 techniques
Sources
13 sources carry it
Identifier
GINC-APT-0017 · moses-staff

What it is

Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.

Security researchers assess Moses Staff is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Vengeful Kitten
Microsoft
Marigold Sandstorm, DEV-0500, DEV-500
MITRE ATT&CK
G1009
PwC
White Dev 95
Other names
MosesStaff, Abraham's Ax, abrahams-ax, Abrahams_Ax, Cobalt Sapling, تبر ابراهیم

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Chile, Germany, India, Israel, Italy, Türkiye, United Arab Emirates, United States
Sectors
Energy, Financial, Government, Manufacturing, Transportation, Utilities

Tools

The tools and malware families the sources tie to it.

  • Archelaus Beta
  • Cyber Eye RAT
  • CyberGate
  • DCSrv
  • PsExec
  • PyDCrypt
  • StrifeWater

Sources