Moses Staff
Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.[1]
Security researchers assess Moses Staff is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.[2]
Associated Group Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1190 | 利用公开应用程序漏洞 |
Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.[1] |
|
| Enterprise | T1562 | .004 | 妨碍防御: Disable or Modify System Firewall |
Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.[1] |
| Enterprise | T1587 | .001 | 开发能力: Malware |
Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.[1] |
| Enterprise | T1505 | .003 | 服务器软件组件: Web Shell |
Moses Staff has dropped a web shell onto a compromised system.[1] |
| Enterprise | T1027 | .013 | 混淆文件或信息: Encrypted/Encoded File |
Moses Staff has used obfuscated web shells in their operations.[1] |
| Enterprise | T1082 | 系统信息发现 |
Moses Staff collected information about the infected host, including the machine names and OS architecture.[1] |
|
| Enterprise | T1016 | 系统网络配置发现 |
Moses Staff has collected the domain name of a compromised network.[1] |
|
| Enterprise | T1588 | .002 | 获取能力: Tool |
Moses Staff has used the commercial tool DiskCryptor.[1] |
| Enterprise | T1087 | .001 | 账号发现: Local Account |
Moses Staff has collected the administrator username from a compromised host.[1] |
| Enterprise | T1105 | 输入工具传输 |
Moses Staff has downloaded and installed web shells to following path |
|
| Enterprise | T1021 | .002 | 远程服务: SMB/Windows Admin Shares |
Moses Staff has used batch scripts that can enable SMB on a compromised host.[1] |
| Enterprise | T1553 | .002 | 颠覆信任控制: Code Signing |
Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.[1] |