Moses Staff
Moses Staff is an Iran-attributed ransomware group with an ideological motive, tracked by Brandefense. It targets 12 sectors, including Government and Technology, in 10 countries, including the United States and India. It uses 29 MITRE ATT&CK techniques and exploits 1 known CVE.
Also known as
- DEV-0500
- Marigold Sandstorm
- Abraham's Ax
- Cobalt Sapling
- Vengeful Kitten
- White Dev 95
- G1009
- Origin
- Iran
- Techniques
- 29
- Exploited CVEs
- 1
- First seen
- Nov 16, 2021
- Last seen
- Nov 16, 2021
- Record updated
Who They Target.
Sectors · 12
Labelsdestructive-activityhack-and-leakiran-nexusisrael-targetingmosesstaffpolitically-motivatedransomware
How They Operate · MITRE ATT&CK.
29 techniques across 12 of 15 tacticsVulnerabilities They Exploit.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- DCSrvmalware
- PyDCryptmalware
- StrifeWatermalware
- DiskCryptortool
- PowerShelltool
- PsExectool
- wmictool
Indicators Of Compromise.
TLP:AMBER+STRICT33 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Moses Staff.
Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.