Abraham's Ax

Abraham's Ax is an Iranian-linked hacktivist persona that emerged in November 2022, conducting destructive cyberattacks against Saudi Arabian government and private sector organizations. The group is closely linked to Moses Staff — sharing malware, infrastructure, and operational patterns — and represents an extension of Iran's MOIS-linked disruptive campaign into the Gulf region. Abraham's Ax claimed responsibility for intrusions and data theft from Saudi targets, publishing stolen data via Telegram and a dedicated website consistent with Moses Staff's established leak-and-shame methodology. Secureworks assessed the group as a subpersona of the Cobalt Sapling / Moses Staff cluster.