MuddyWater Phishing Campaign Impersonates Israel Tax Authority to Deploy SimpleHelp RAT
A suspected MuddyWater campaign, attributed with moderate confidence by Cato CTRL, has targeted Israeli finance and accounting staff since September 2026 using phishing emails impersonating the Israel Tax Authority. Victims are lured to lookalike domains such as document-govil.com, asked to enter a shared password (123123), and then download an archive (Israel_Tax_Authority.zip/document.zip) containing an executable disguised as a tax document. The payload actually installs SimpleHelp Remote Access Client v5.4.5 configured to beacon to an external server, giving attackers remote desktop, terminal, and file-transfer access. Automated cloud threat prevention blocked communications to the attacker infrastructure before operators could establish active remote sessions, and no vulnerability in SimpleHelp itself was exploited—the intrusion relies entirely on social engineering.
Detalhes técnicos
Researchers identified the command-and-control/staging IP 129.121.120.121 and used FOFA searches on the attacker's HTTP ETag signature to uncover eight related service records tied to this infrastructure. The lure chain begins with a phishing email directing victims to a fake government portal, followed by a password-gated download page, then execution of a Hebrew-named or document.exe file that silently installs the legitimate SimpleHelp remote administration tool rather than displaying any tax document. SimpleHelp confirmed the version used and cooperated with researchers on the infrastructure review. This technique mirrors prior MuddyWater activity documented by Group-IB and HarfangLab involving SimpleHelp installers, and is similar to a March 2024 Proofpoint-tracked campaign using Hebrew payroll lures to deploy Atera.
Remediação
Organizations should block connections to 129.121.120.121, strengthen email filtering against lookalike government domains, train finance/accounting staff to verify tax notices directly with official authorities, restrict execution of unauthorized remote management tools, and monitor endpoints for unexpected SimpleHelp or other RAT installations.
Linha do tempo
-
MuddyWater Phishing Campaign Impersonates Israel Tax Authority to Deploy SimpleHelp RAT
ler a análise desta fonte ocultar
A suspected MuddyWater campaign, attributed with moderate confidence by Cato CTRL, has targeted Israeli finance and accounting staff since September 2026 using phishing emails impersonating the Israel Tax Authority. Victims are lured to lookalike domains such as document-govil.com, asked to enter a shared password (123123), and then download an archive (Israel_Tax_Authority.zip/document.zip) containing an executable disguised as a tax document. The payload actually installs SimpleHelp Remote Access Client v5.4.5 configured to beacon to an external server, giving attackers remote desktop, terminal, and file-transfer access. Automated cloud threat prevention blocked communications to the attacker infrastructure before operators could establish active remote sessions, and no vulnerability in SimpleHelp itself was exploited—the intrusion relies entirely on social engineering.
Technical Details
Researchers identified the command-and-control/staging IP 129.121.120.121 and used FOFA searches on the attacker's HTTP ETag signature to uncover eight related service records tied to this infrastructure. The lure chain begins with a phishing email directing victims to a fake government portal, followed by a password-gated download page, then execution of a Hebrew-named or
document.exefile that silently installs the legitimate SimpleHelp remote administration tool rather than displaying any tax document. SimpleHelp confirmed the version used and cooperated with researchers on the infrastructure review. This technique mirrors prior MuddyWater activity documented by Group-IB and HarfangLab involving SimpleHelp installers, and is similar to a March 2024 Proofpoint-tracked campaign using Hebrew payroll lures to deploy Atera.Remediation
Organizations should block connections to 129.121.120.121, strengthen email filtering against lookalike government domains, train finance/accounting staff to verify tax notices directly with official authorities, restrict execution of unauthorized remote management tools, and monitor endpoints for unexpected SimpleHelp or other RAT installations.