MosesStaff
MosesStaff is an Iran-attributed ransomware group with an ideological motive, tracked by Brandefense. It targets 12 sectors, including Government and Technology, in 9 countries, including the United States and the United Kingdom. It uses 40 MITRE ATT&CK techniques and exploits 1 known CVE.
Also known as
- DEV-0500
- Marigold Sandstorm
- Abraham's Ax
- Cobalt Sapling
- Vengeful Kitten
- White Dev 95
- G1009
- Origin
- Iran
- Techniques
- 40
- Exploited CVEs
- 1
- First seen
- Nov 16, 2021
- Last seen
- Nov 16, 2021
- Record updated
Who They Target.
Sectors · 12
Labelsdestructive-activityhack-and-leakiran-nexusisrael-targetingmosesstaffpolitically-motivatedransomware
About MosesStaff.
Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.