Moses Staff

Profile narrative

Moses Staff is an Iranian‑based hacking group that operates under the alias Moses Staff and has been publicly linked to Iran in threat intelligence reporting. The actor is known for targeting Israeli entities, particularly focusing on civilian surveillance infrastructure such as CCTV cameras. Public attributions describe the group as originating from Iran, and its activities have been reported by Israeli media outlets and security firms.

The group’s observed targeting includes defense‑related facilities, urban surveillance networks, and senior officials, and senior Israeli officials, as evidenced by the compromise of cameras near the Rafael defense contractor factory in Haifa and across cities like Jerusalem and Tel Aviv. Moses Staff’s stated objectives, derived from its own communications and the content it released, involve conducting prolonged espionage‑style surveillance and signaling an intent to conduct future disruptive actions, which aligns with an espionage‑oriented strategic goal rather than financially motivated crime. The actor has not been described as seeking monetary gain‑driven in any of the available sources.

In terms of tactics, Moses Staff’s operations have centered on exploiting vulnerabilities in CCTV camera systems to gain persistent control over the devices, maintaining access for extended periods, and then using the compromised feeds to collect and disseminate video footage. The group has utilized its Telegram channel as a primary tool for publishing the acquired videos and communicating its claims, indicating a reliance on accessible messaging platforms for information operations. No specific malware families or custom tooling have been referenced in the reporting, with the emphasis instead on the compromise of camera hardware and the subsequent use of those devices for surveillance and propaganda. The most notable publicly reported operation involves the 2021‑2022 intrusion into dozens of Israeli CCTV cameras, during which Moses Staff captured and released footage of defense sites, urban areas, and a terror attack, asserting ongoing surveillance and a future strike capability. This campaign exemplifies the group’s focus on intelligence gathering through accessible civilian infrastructure and its use of leaked media to exert psychological pressure.

Incidents

Attributed incidents are available to members.