MosesStaff is a relatively small ransomware group that emerged in December 2021, primarily motivated by ideological and political objectives rather than financial gain, specifically targeting Israeli organizations and entities. The group is believed to operate independently and has been linked to pro-Palestinian hacktivist activities, though their exact country of origin remains unclear based on publicly available intelligence. MosesStaff employs standard ransomware deployment techniques including data exfiltration prior to encryption, utilizing custom malware tools and focusing on complete data theft rather than traditional ransom demands, often publicly releasing stolen data on their leak sites as part of their destructive methodology. The group has conducted targeted attacks against Israeli companies and government entities, with their operations characterized by relatively low victim counts but high-impact data breaches designed to cause reputational and operational damage to their targets. MosesStaff remains active as of current intelligence reporting, continuing to conduct sporadic attacks aligned with their ideological motivations against Israeli interests. The group has been linked to 16 public disclosures across our corpus. First observed on a leak site on December 18, 2021. The operation is currently inactive.
Also tracked as: Moses Staff, Marigold Sandstorm, DEV-0500, VENGEFUL KITTEN.
If your organisation is affected
A listing by Mosesstaff means Epsilor Company appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.
- Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
- Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
- Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
- Monitor for the data appearing on Mosesstaff's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.
How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.
