apt

Moses Staff

dormant · last signal 3y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Cobalt SaplingDEV-0500Marigold SandstormAbraham's Ax

Attribution

Iran — assessed state-aligned operating behind a hacktivist front (medium confidence; no MITRE Group ID)

Origin

Iran

First seen

2021

Last active

2023

Motivation

Sabotage

Attribution confidence

medium

MENA targeting

Israel, Saudi Arabia

Sectors

Government, critical infrastructure, engineering, finance

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel, Saudi Arabia (Government, critical infrastructure, engineering sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

GhostSec / GhostLockeractorTechnique overlap
IncRansomactorTechnique overlap
CactusactorTechnique overlap
Emennet PasargadactorTechnique overlap
RhysidaactorTechnique overlap
RansomHouseactorTechnique overlap
KillSecactorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap
Qilin (fka Agenda)

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?