New ‘Moses Staff’ Hacker Group Targets Israeli Companies With Destructive Attacks

A new politically-motivated hacker group named “Moses
Staff” has been linked to a wave of targeted attacks
targeting Israeli organizations since September 2021 with the goal
of plundering and leaking sensitive information prior to encrypting
their networks, with no option to regain access or negotiate a
ransom.

“The group openly states that their motivation in attacking
Israeli companies is to cause damage by leaking the stolen
sensitive data and encrypting the victim’s networks, with no ransom
demand,” Check Point Research said^[1]
in a report published Monday. “In the language of the attackers,
their purpose is to ‘Fight against the resistance and expose the
crimes of the Zionists in the occupied territories.'”

At least 16 victims have had their data leaked to date,
according to stats released by the collective.

The threat actor is said to leverage publicly known
vulnerabilities as a means to breach enterprise servers and gain
initial access, following it up with the deployment of a custom
web shell^[2]
that’s used to drop additional malware. Once inside, the intruders
take advantage of living-off-the-land (LotL^[3]) techniques to laterally
move across the network and deploy malware to lock the machines
behind encryption barriers via a specially-crafted PyDCrypt
malware.

The attacks specifically rely on the open-source library
DiskCryptor^[4]
to perform volume encryption, in addition to infecting the systems
with a bootloader^[5]
that prevents them from starting without the correct encryption
key. The goal, the researchers said, is to disrupt operations and
inflict “irreversible damage” to the victims.

That said, the encrypted files can be recovered under certain
scenarios since the group uses a symmetric key^[6]
mechanism to generate the encryption keys. Check Point did not
attribute the adversary to any specific country, citing lack of
definitive evidence, but noted that some artifacts of the group’s
toolset had been submitted^[7]
to VirusTotal from Palestine months prior to the first attack.

Moses Staff also operates^[8]
Twitter and Telegram to publicize their attacks, with malicious
activity reported as recently as November 14. The group’s own
website claims it has targeted over 257 websites as well as stolen
data and documents amounting to 34 terabytes. What’s more, the
online portal urges outside parties to join hands with them in
“exposing the crimes of the Zionists in occupied Palestine.”

“Moses Staff are still active, pushing provocative messages and
videos in their social network accounts,” the researchers said.
“The vulnerabilities exploited in the group’s attacks are not zero
days, and therefore all potential victims can protect themselves by
immediately patching all publicly-facing systems.”