H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

DCSrv

[DCSrv](https://attack.mitre.org/software/S1033) is destructive malware that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021. Though [DCSrv](https://attack.mitre.org/software/S1033) has ransomware-like capabilities, [Moses Staff](https://attack.mitre.org/groups/G1009) does not demand ransom or offer a decryption key.(Citation: Checkpoint MosesStaff Nov 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[DCSrv](https://attack.mitre.org/software/S1033) is destructive malware that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021. Though [DCSrv](https://attack.mitre.org/software/S1033) has ransomware-like capabilities, [Moses Staff](https://attack.mitre.org/groups/G1009) does not demand ransom or offer a decryption key.(Citation: Checkpoint MosesStaff Nov 2021)

Labels

malware
9 recorded

Relationships

uses
to Data Encrypted for Impact
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Masquerade Task or Service
Technique
uses
to Modify Registry
Technique
uses
to Native API
Technique
uses
to System Shutdown/Reboot
Technique
uses
to System Time Discovery
Technique
uses
to Windows Service
Technique
uses
from Moses Staff
Group
2 external

References

mitre-attack
S1033
open
Checkpoint MosesStaff Nov 2021
https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance