Moses Staff has downloaded and installed web shells to following path

Moses Staff collected information about the infected host, including the machine names and OS architecture.(Citation: Checkpoint MosesStaff Nov 2021)
|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Moses Staff has collected the domain name of a compromised network.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Moses Staff has used obfuscated web shells in their operations.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Moses Staff has built malware, such as

DCSrv and

PyDCrypt, for targeting victims' machines.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Moses Staff has used the commercial tool DiskCryptor.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Moses Staff has dropped a web shell onto a compromised system.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.(Citation: Checkpoint MosesStaff Nov 2021)|