Cobalt Sapling

Cobalt Sapling is Secureworks' designation for the Iranian threat cluster known as Moses Staff, linked to Iran's Ministry of Intelligence and Security (MOIS). Active since at least 2021, the group targets Israeli and, through the Abraham's Ax persona, Saudi Arabian organizations using wiper malware disguised as ransomware combined with data theft and public leak operations. Secureworks tracks both Moses Staff and Abraham's Ax under the Cobalt Sapling umbrella, assessing them as the same underlying MOIS-linked Iranian operator using different personas for different regional targets.