Moses Staff

Moses Staff, an Iranian Advanced Persistent Threat (APT) group, has emerged as a significant cybersecurity threat. The Cybereason Nocturnus Team has been monitoring the activities of this group since 2021, and it has been linked to several major ransomware-style attacks. Initially categorized as hacktivists, more in-depth analysis revealed that Moses Staff's operations are more sophisticated than typical hacktivist activities, posing a greater threat. Notably, they have deployed an undocumented Remote Access Trojan (RAT) named StrifeWater in the initial stages of their attacks, demonstrating a high level of technical expertise. The discovery of the StrifeWater RAT was facilitated by the analysis of a new variant of the PyDCrypt malware used by Moses Staff. This RAT is being used in targeted ransomware attacks and its deployment indicates a shift towards more advanced and persistent threats. The group's tactics include phishing attacks and remote exploitation, which align with the MITRE AT&CK Framework, a globally-accessible knowledge base of adversary tactics and techniques. Furthermore, Moses Staff's activities have shown overlaps with other known Iranian hacktivist groups, further complicating attribution efforts. Moses Staff has been implicated in several high-profile cyberattacks, including a claim to have hacked the Israeli Dorad power facility. However, these claims were found to be recycled from a previous breach announced in June 2022. The group has also been associated with other pro-Iranian government fronts like N3tW0rm and Agrius, indicating a coordinated effort among these entities. Additionally, the group has been connected to the Karma operation, a pro-Hamas hacktivist campaign deploying the BiBi-Linux Wiper malware against Israeli targets. Overall, the group's sophisticated tactics and persistent nature have led to its elevation from a hacktivist group to APT status.