Mosesstaff
Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.
Victims
16
First Discovered
2021-12-18
victim
Last Discovered
2021-12-18
victim
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
N/A
victims with domain
Countries
0
hit
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-05-27T10:49:34 |
mosesstaffm7hptp.onion
|
||||
|
Database Error | No | 2026-04-28T07:27:16 |
moses-staff.se
|
Target
Top 5 Activity Sectors
- Technology 4
- Government & Defense 3
- Manufacturing 3
- Financial Services 1
- Professional Services 1
Top 5 Countries
Heatmap
TTPs Matrix (8)
| Initial Access | Persistence | Stealth | Discovery | Lateral Movement | Command and Control | Resource Development | Defense Impairment |
|---|---|---|---|---|---|---|---|
| Exploit Public-Facing Application | Server Software Component: Web Shell | Obfuscated Files or Information: Encrypted/Encoded File | System Network Configuration Discovery | Remote Services: SMB/Windows Admin Shares | Ingress Tool Transfer | Develop Capabilities: Malware | Subvert Trust Controls: Code Signing |
| System Information Discovery | Obtain Capabilities: Tool | Disable or Modify System Firewall: Windows Host Firewall | |||||
| Account Discovery: Local Account |
YARA Rules (1)
Victims (16)
