Cato CTRL Research on Suspected Iranian MuddyWater Activity Using Israel Tax Authority Lures and SimpleHelp

Executive Summary

We investigated a campaign targeting Israeli organizations through phishing emails impersonating the Israel Tax Authority. The activity has been observed since September 2026. Government-themed domains and a verification page lead recipients to ZIP archives containing executables disguised as tax-related documents. The campaign abuses SimpleHelp, a legitimate remote monitoring and management tool, to enable attacker-directed remote access.

The lure exploits a routine business task and can reach finance, accounting, and administrative staff across sectors. We suspect a connection to MuddyWater based on its documented use of SimpleHelp and targeting of Israel.

Key Findings

• The campaign uses Israel Tax Authority impersonation and government-themed domains to distribute ZIP archives to Israeli organizations.
• The payload is presented as a tax-related document but is a SimpleHelp executable.
• Cato telemetry recorded threat prevention alert against campaign web infrastructure. The event demonstrates prevention of that request, without establishing a completed remote-access session.

Attack Flow

Figure 1 summarizes the delivery chain. Remote access depends on successful execution and activation of the SimpleHelp component.

Figure 1. Tax authority impersonation leads to a SimpleHelp executable. The dashed final step represents potential remote access following successful execution.

Technical Details and Analysis

This activity was previously described in public reporting by CyberIL. Our investigation examined the campaign’s delivery infrastructure and use of SimpleHelp.

From a tax themed email to a verification page

The attack begins with a phishing email impersonating the Israel Tax Authority. Recipients attempting to access the supposed personal area are directed to a lookalike site and prompted to complete a CAPTCHA-style verification step before downloading a ZIP archive.

The infrastructure uses names such as document-govil[.]com to resemble the official Israeli government namespace, gov.il. The string govil is part of a separately registered domain and does not indicate government affiliation.

The verification page in Figure 2 displays a checkbox, a Continue button, and the password 123123. This presentation reinforces the appearance of a protected document-delivery process.

Figure 2. Verification interface used in the tax authority lure.

A ZIP archive delivers the executable

Following the verification step, the download is presented as a tax-related archive. Figure 3 shows Israel_Tax_Authority.zip in the browser download history. The investigation also identifies an archive named document.zip.

Figure 3. Download of Israel_Tax_Authority.zip.

The agency-themed naming continues inside the archive. The executable shown in Figure 4 is named רשות המסים בישראל.exe, meaning “Israel Tax Authority.” A recipient expecting a tax document is instead presented with a program to run. The payload inventory also includes document.exe.

Figure 4. Executable named רשות המסים בישראל.exe presented under the tax authority pretext.

SimpleHelp provides the remote access capability

SimpleHelp is legitimate remote support software. In this campaign, it is used as the remote-access component behind the document lure. The research identifies 129.121.120[.]121 as associated command-and-control infrastructure.

Successful deployment can allow an operator to connect to the endpoint and continue the intrusion using the software’s built-in capabilities. The table below maps vendor-documented features to potential attacker use and business impact. It describes capabilities rather than observed post-compromise actions.

These capabilities are described in SimpleHelp’s feature documentation, Toolbox Guide, and Remote Access Guide.

The activity involved social engineering and abuse of legitimate RMM functionality. Our findings and SimpleHelp’s assessment are summarized in the disclosure section below.

Mapping the infrastructure with FOFA

We searched FOFA for the two observed HTTP ETag values. The search returned eight service records associated with 129.121.120[.]121, including records for document-govil[.]com and document-govil[.]online, as shown in Figure 5. Both domains displayed “Coming Soon” pages served by nginx.

Figure 5. FOFA results linking the two domains to 129.121.120[.]121. The eight results are service records on one IP.

Public reporting on SimpleHelp abuse

Group-IB previously documented MuddyWater’s use of SimpleHelp, providing context for our attribution assessment. Sophos, CISA, and Huntress have also reported separate ransomware incidents involving SimpleHelp exploitation or abuse.

Attribution Assessment

We suspect MuddyWater involvement based on the combination of Israeli organizational targeting, locally tailored authority impersonation, and delivery of legitimate remote-access software through phishing. HarfangLab documented an October 2023 MuddyWater phishing email linking to a SimpleHelp installer. Proofpoint documented Hebrew payroll lures in March 2024 that led Israeli recipients through PDF links to ZIP archives containing Atera installers.

Earlier campaigns also used institution-themed Egnyte subdomains and Hebrew filenames related to scholarships and tourism. These examples show a recurring approach of adapting recognizable Israeli identities and routine business tasks to persuade recipients to install remote-access software. The current campaign follows a similar pattern through Israel Tax Authority impersonation and tax-themed filenames.

The February 2022 joint government advisory identifies MuddyWater as a subordinate element of Iran’s Ministry of Intelligence and Security.

Disclosure Timeline

SimpleHelp is legitimate remote monitoring and management (RMM) software. Based on the evidence reviewed and validation with SimpleHelp, we did not identify exploitation of a SimpleHelp vulnerability or compromise of SimpleHelp’s own infrastructure in connection with this campaign. The activity investigated involved social engineering intended to induce users to deploy SimpleHelp configured to connect to attacker-controlled infrastructure, consistent with the broader abuse of legitimate RMM tools by threat actors.

SimpleHelp confirmed that both samples identify themselves as SimpleHelp Remote Access Client version 5.4.5. Based on the information we provided, SimpleHelp assessed the activity as apparent malicious use of an older release and stated that it had not seen evidence indicating exploitation of a SimpleHelp vulnerability. SimpleHelp offered to investigate associated infrastructure and assess available action, requesting server addresses or hostnames, observation timestamps, and supporting evidence through a private file request. We subsequently shared the relevant server list with SimpleHelp.

Cato Protection

Cato automatically blocks the campaign domains and IOCs listed below, protecting Cato customers against these identified threats without requiring manual indicator updates.

In addition, Cato MDR provides 24/7 threat monitoring, investigation, and response for suspicious activity involving remote-access tools and attacker-controlled infrastructure.

Figure 6 shows a Cato IPS event with the action recorded as Block for a request to document-govil[.]com/Form/Forms/, with destination IP 129.121.120[.]121.

Figure 6. Cato telemetry showing an IPS Block event against campaign infrastructure.

Indicators of Compromise

Network Infrastructure

File Hashes