Threat Intelligence Tarot
wands · 2
Iran (IRGC-linked)
★★★★★
risk 4/5
✦ The Flood ✦
Moses Staff
Abraham's Ax
IsraelIsraeli governmentIsraeli defenseIsraeli financial sector
Active since ~2021 · Israeli government disruption, Leak-and-destroy operations, Psychological warfare
Moses Staff takes what it finds, publishes it to embarrass, then destroys the systems it came from. It is a weapon designed for humiliation as much as harm - the stolen document, the leaked database, the encrypted server. The Flood leaves nothing clean.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Israeli government data leaks paired with encryption attacks
- ◆Bait-and-release: exfiltrate, then destroy, then publish
- ◆ProxyShell exploitation for initial access into Israeli networks
- ◆Claimed access to Israeli defense infrastructure (2021–2022)
Defenses
- ▸Patch management prioritizing internet-facing Exchange and IISCIS Control 7 ↗
- ▸Immutable backup systems geographically isolatedCIS Control 11 ↗
- ▸Data loss prevention and exfiltration monitoringNIST CSF: PR.DS ↗
- ▸Crisis communications plan for data leak scenariosNIST CSF: RC.CO ↗
Reversed: Their Weakness
Moses Staff's combination of espionage and destruction operations muddies attribution - the simultaneous leak-and-destroy approach means victims must simultaneously do breach response, incident response, and public communications, stretching defensive resources dangerously thin.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.