Moses Staff Cluster

Moses Staff is an Iranian state-linked hacktivist threat cluster that emerged in September 2021, conducting politically motivated cyberattacks exclusively against Israeli organizations. The group is linked to Iran's Ministry of Intelligence and Security (MOIS) and operates at the intersection of espionage and psychological operations — combining data theft with publicly claimed destructive attacks to maximize reputational and operational damage to Israeli targets.

Targets and Goals

Moses Staff has exclusively targeted Israeli organizations across government, military, finance, energy, media, and IT sectors. The group's stated goal is political — it openly declares its purpose as harming Israeli interests — rather than financial. Operations follow a pattern of initial intrusion, data exfiltration, and then destructive payload deployment, after which stolen data is leaked publicly on the group's Telegram channel and website to amplify the psychological impact.

Tooling and Tactics

Moses Staff gains initial access by exploiting known vulnerabilities in public-facing applications, particularly Microsoft Exchange servers and web applications. The group uses custom malware including PyDCrypt (a Python-based encryptor) and DCSrv (a destructive tool that abuses the legitimate DiskCryptor driver to encrypt system volumes without providing decryption keys — effectively a wiper disguised as ransomware). Post-compromise activity includes credential dumping, network reconnaissance, and lateral movement before deploying the destructive payload. The group leaks stolen data regardless of whether the destructive payload succeeds.

Aliases

Moses Staff is tracked as Cobalt Sapling by Secureworks and DEV-0500 / Marigold Sandstorm by Microsoft. The related persona Abraham's Ax was used for a distinct but overlapping campaign targeting Saudi Arabian organizations in late 2022 and early 2023.