Mosesstaff

How Mosesstaff typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Moses Staff.

1. T1587.001 Malware Resource Development

   What they do: Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.

   What that means: Adversaries may develop malware and malware components that can be used during targeting.

2. T1588.002 Tool Resource Development

   What they do: Moses Staff has used the commercial tool DiskCryptor.

   What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.

3. T1190 Exploit Public-Facing Application Initial Access

   What they do: Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.

   What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

4. T1505.003 Web Shell Persistence

   What they do: Moses Staff has dropped a web shell onto a compromised system.

   What that means: Adversaries may backdoor web servers with web shells to establish persistent access to systems.

5. T1027.013 Encrypted/Encoded File Stealth

   What they do: Moses Staff has used obfuscated web shells in their operations.

   What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

6. T1553.002 Code Signing Defense Impairment

   What they do: Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.

   What that means: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

7. T1686.003 Windows Host Firewall Defense Impairment

   What they do: Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.

   What that means: Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage.

8. T1016 System Network Configuration Discovery Discovery

   What they do: Moses Staff has collected the domain name of a compromised network.

   What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

9. T1082 System Information Discovery Discovery

   What they do: Moses Staff collected information about the infected host, including the machine names and OS architecture.

   What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

10. T1087.001 Local Account Discovery

    What they do: Moses Staff has collected the administrator username from a compromised host.

    What that means: Adversaries may attempt to get a listing of local system accounts.

11. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: Moses Staff has used batch scripts that can enable SMB on a compromised host.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

12. T1105 Ingress Tool Transfer Command and Control

    What they do: Moses Staff has downloaded and installed web shells to following path C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx.

    What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.