Suspected MuddyWater Phishing Campaign Impersonates Israel Tax Authority to Deploy SimpleHelp RMM
Since September 2026, Israeli organizations have been targeted by a phishing campaign impersonating the Israel Tax Authority, luring finance, accounting, and administrative personnel with fake tax documents that deliver the legitimate SimpleHelp remote monitoring and management tool. Cato Networks attributes suspected involvement to MuddyWater based on targeting patterns and the group's documented history of abusing legitimate RAT tools, though attribution remains unconfirmed. The attack relies entirely on social engineering rather than software exploitation, directing victims to lookalike domains mimicking Israel's official gov.il namespace before delivering a password-protected archive containing a disguised SimpleHelp installer.
Detalhes técnicos
Phishing emails direct recipients to lookalike domains such as document-govil[.]com and document-govil[.]online, which imitate the Israeli government's gov.il namespace but are independently registered. Victims encounter a CAPTCHA-style page with password 123123 before downloading archives named Israel_Tax_Authority.zip and document.zip, containing executables document.exe and רשות המסים בישראל.exe (
Linha do tempo
-
Suspected MuddyWater Phishing Campaign Impersonates Israel Tax Authority to Deploy SimpleHelp RMM
ler a análise desta fonte ocultar
Since September 2026, Israeli organizations have been targeted by a phishing campaign impersonating the Israel Tax Authority, luring finance, accounting, and administrative personnel with fake tax documents that deliver the legitimate SimpleHelp remote monitoring and management tool. Cato Networks attributes suspected involvement to MuddyWater based on targeting patterns and the group's documented history of abusing legitimate RAT tools, though attribution remains unconfirmed. The attack relies entirely on social engineering rather than software exploitation, directing victims to lookalike domains mimicking Israel's official gov.il namespace before delivering a password-protected archive containing a disguised SimpleHelp installer.
Technical Details
Phishing emails direct recipients to lookalike domains such as document-govil[.]com and document-govil[.]online, which imitate the Israeli government's gov.il namespace but are independently registered. Victims encounter a CAPTCHA-style page with password 123123 before downloading archives named Israel_Tax_Authority.zip and document.zip, containing executables document.exe and רשות המסים בישראל.exe (