Moses Staff

Moses Staff is an Iranian MOIS-linked hacktivist group that emerged in September 2021, conducting destructive cyberattacks and data theft exclusively against Israeli organizations across government, military, finance, and IT sectors. The group uses wiper malware disguised as ransomware — including the PyDCrypt encryptor and DCSrv tool — combined with public data leaks to maximize political and psychological impact. Moses Staff is tracked as Cobalt Sapling by Secureworks and DEV-0500/Marigold Sandstorm by Microsoft. The Abraham's Ax persona represents a related operation targeting Saudi Arabian organizations.