DCSrv — Malware Profile
DCSrv is destructive malware that has been used by Moses Staff since at least September 2021. Though DCSrv has ransomware-like capabilities, Moses Staff does not demand ransom or offer a decryption key.
MITRE ATT&CK techniques (8)
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1106 Native API
- T1112 Modify Registry
- T1124 System Time Discovery
- T1486 Data Encrypted for Impact
- T1529 System Shutdown/Reboot
- T1543.003 Windows Service
IntelFusions coverage
- MosesStaff Technical Analysis: PyDCrypt Loader and DCSrv Wiper Use DiskCryptor for Ideologically Motivated Destruction Without Ransom 2026-02-16
- Abraham's Ax Linked to Moses Staff: COBALT SAPLING Operates Dual Hacktivist Personas Targeting Israel and Saudi Arabia 2026-02-16