CVE Intelligence
Home / Threat actors / Moses Staff

Moses Staff G1009

🔔 Create alert

Also known as: DEV-0500, Marigold Sandstorm

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
12
Techniques
4
Malware and tools

Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.

Security researchers assess Moses Staff is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.

Ransomware operations linked to this group ransomware.live

mosesstaff

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development
T1587.001 MalwareT1588.002 Tool
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Web Shell
Stealth
T1027.013 Encrypted/Encoded File
Defense Impairment
T1553.002 Code SigningT1686.003 Windows Host Firewall
Discovery
T1016 System Network Configuration DiscoveryT1082 System Information DiscoveryT1087.001 Local Account
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Command and Control
T1105 Ingress Tool Transfer

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.