In this hands-on training scenario, participants will step into the shoes of a cyber threat intelligence analyst tasked with investigating the notorious Iranian APT group, Moses Staff. Known for their politically-motivated cyber operations against Israeli organizations, this group employs sophisticated tactics to not only disrupt but also to make a political statement through data leaks. Trainees will delve into the analysis of the DCSrv wiper malware, uncovering the methods used by this APT to infiltrate and compromise targets. By following the trail of alerts, participants will learn to piece together a comprehensive picture of the attack, understanding the motivations and techniques of the adversary.