Moses Staff
Threat actorAttributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Moses StaffOur name
- DEV-0500Microsoft
- Marigold SandstormMicrosoft
Targets
Sectors: Government, Energy, Finance, Manufacturing
Regions: United States, India, Israel, Germany
Source: MITRE ATT&CKKnown techniques
- T1016System Network Configuration Discovery
- T1021.002SMB/Windows Admin Shares
- T1027.013Encrypted/Encoded File
- T1082System Information Discovery
- T1087.001Local Account
- T1105Ingress Tool Transfer
- T1190Exploit Public-Facing Application
- T1505.003Web Shell
- T1553.002Code Signing
- T1587.001Malware
- T1588.002Tool
- T1686.003Windows Host Firewall
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.