Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
Do Son 
Attack Flow | Image: Cato Networks
TL;DR
Security researchers uncovered a MuddyWater SimpleHelp campaign that has targeted Israeli businesses since September 2026. Phishing messages impersonate the Israel Tax Authority to trick finance workers into installing remote management software. Furthermore, automated cloud protections blocked requests to the attacker server before operators could establish remote control.
What Happened in the Campaign
Threat actors sent phishing emails impersonating the Israel Tax Authority to administrative and accounting employees. According to an investigation into the MuddyWater SimpleHelp campaign by Cato CTRL, the emails directed recipients to lookalike government portals. Specifically, attackers registered deceptive domains such as document-govil.com to mimic official government portals. “The string govil is part of a separately registered domain and does not indicate government affiliation,” Cato researchers noted.
Once victims reached the fraudulent site, a verification page prompted them to enter the password 123123. Next, the website prompted the visitor to download a compressed archive named Israel_Tax_Authority.zip or document.zip. Inside the archive, the actors placed an executable file named with Hebrew text meaning “Israel Tax Authority” or document.exe. However, running this file did not display tax documents. Instead, it launched an installer for SimpleHelp Remote Access Client version 5.4.5 configured to contact an external server at 129.121.120.121.
Abuse of Legitimate Administrative Software
SimpleHelp is a legitimate remote support application that allows administrators to manage remote computers. Consequently, running the software provides attackers with remote desktop control, terminal execution, and file transfer capabilities. “The payload is presented as a tax-related document but is a SimpleHelp executable,” Cato CTRL analysts emphasized in their report.
During the investigation, researchers searched the FOFA search engine for the attacker’s HTTP ETag signatures. As a result, the search uncovered eight service records associated with the central IP address. Moreover, researchers confirmed that the intruders did not exploit a software flaw in SimpleHelp itself. Instead, the attackers abused the tool through social engineering to gain interactive access. SimpleHelp confirmed the files used version 5.4.5 and cooperated with researchers to review the infrastructure.
Who Is Behind the Activity
Cato CTRL attributes this intrusion set to the Iranian threat group MuddyWater with moderate confidence. Independent reporting from Israeli threat intelligence group CyberIL previously highlighted similar tax-themed phishing activity in the region. Furthermore, earlier investigations by Group-IB and HarfangLab documented repeated MuddyWater operations that used SimpleHelp installers to access victim networks. Proofpoint also tracked similar campaigns in March 2024 where Iranian operators used Hebrew payroll lures to deploy Atera software.
“The lure exploits a routine business task and can reach finance, accounting, and administrative staff across sectors,” Cato CTRL noted. Western intelligence agencies identify MuddyWater as a cyber espionage team subordinate to Iran’s Ministry of Intelligence and Security (MOIS). The group routinely adopts regional themes, Hebrew filenames, and commercial administration tools to blend in with normal network traffic.
Impact and Scale Across Targets
The MuddyWater SimpleHelp campaign in Israel focuses on stealing access to corporate networks across diverse economic sectors. By targeting finance workers, the intruders seek access to machines handling payroll, tax filings, and banking data. Fortunately, network telemetry from Cato Networks recorded automated threat prevention alerts against the campaign domains. As a result, security defenses stopped the communication before attackers established an active remote access session.
How Organizations Can Stay Protected
Defenders must strengthen their email filters to stop lookalike government domains from reaching employee inboxes. Organizations should instruct staff to inspect downloaded archives and verify unusual tax notices directly with official authorities. Additionally, security teams must restrict the execution of unauthorized remote management tools across enterprise endpoints. Network administrators should block connections to 129.121.120[.]121 and monitor systems for unexpected installations of SimpleHelp or other remote access clients.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
