MuddyWater Hackers Suspected of Targeting Israeli Organizations With Fake Tax Authority Emails

Israeli organizations have been targeted since September 2026 in a phishing campaign impersonating the Israel Tax Authority and distributing SimpleHelp remote monitoring and management software disguised as tax documents.

Investigators suspect MuddyWater involvement, citing the targeting and its documented abuse of legitimate remote-access tools, but the attribution remains unconfirmed.

Rather than exploiting software vulnerabilities, the attackers attempt to persuade recipients to download and execute a program configured for attacker-controlled infrastructure.

The phishing emails direct recipients seeking access to a supposed personal tax area to a lookalike website. Government-themed domains, including document-govil[.]com, imitate Israel’s official gov.il namespace.

However, “govil” belongs to a separately registered domain and provides no evidence of government affiliation.

Recipients encounter a CAPTCHA-style verification page displaying a checkbox, a Continue button, and the password 123123.

This interface frames the subsequent download as a protected document-delivery process, reinforcing the tax authority pretext.

The Hebrew agency name sustains the document lure while concealing that recipients are being asked to launch software.

The executable delivers SimpleHelp, a legitimate remote support platform. Successful execution and activation could enable attacker-directed access; downloading the archive alone does not establish compromise.

SimpleHelp’s documentation also distinguishes launching its standard Remote Access executable from actually starting the associated service.

Cato Networks investigation said that, a delivery chain built around routine tax administration, potentially exposing finance, accounting, and administrative personnel across sectors.

Fake Tax Authority Emails

Investigators associated 129.121.120[.]121 with the campaign’s command-and-control infrastructure.

Searches in FOFA using two observed HTTP ETag values returned eight service records linked to that address, including document-govil[.]com and document-govil[.]online. Both domains displayed nginx-served “Coming Soon” pages.

The downloaded archives include Israel_Tax_Authority.zip and document.zip. Inside, investigators identified executables named document.exe and רשות המסים בישראל.exe, meaning “Israel Tax Authority.”

Those eight results represent service records on one IP address, not eight independently identified servers. This distinction limits how broadly you should interpret the infrastructure findings.

Cato telemetry recorded a threat-prevention alert involving campaign web infrastructure.

The event establishes that the specific request was prevented, but it does not demonstrate successful payload execution, service activation, or a completed remote-access session.

If activated, SimpleHelp can provide desktop control, terminal access, file transfer, and system diagnostics. Its Toolbox functionality supports repeatable commands, scripts, and resource delivery.

These features describe potential attacker capabilities, not observed post-compromise actions in this investigation.

The assessment draws on historical tradecraft rather than definitive attribution. Group-IB previously documented MuddyWater operating legitimate SimpleHelp clients and associated server infrastructure.

HarfangLab subsequently described an October 2023 phishing email linking to a SimpleHelp installer.

Proofpoint reported another parallel in March 2024: Hebrew payroll-themed emails targeting Israeli employees, with PDF links leading to ZIP archives containing Atera installers.

Together, these campaigns illustrate a recurring method of turning familiar business workflows into remote-access installation opportunities.

A February 2022 joint government advisory identifies MuddyWater as subordinate to Iran’s Ministry of Intelligence and Security.

That established organizational attribution does not independently prove responsibility for this campaign.

Following validation with SimpleHelp, investigators reported no identified exploitation of a SimpleHelp vulnerability or compromise of its infrastructure.

The finding separates this social-engineering operation from separately documented ransomware incidents involving vulnerable SimpleHelp servers, preventing unrelated exploitation activity from being conflated with the Israeli tax-themed phishing campaign described here.

Indicators of Compromise

Indicator	Role in the research inventory
doc-taxes-govil[.]org	ZIP delivery infrastructure
document-govil[.]com	ZIP delivery infrastructure and destination in the Cato Block event
doc26-govil[.]org	ZIP delivery infrastructure
document-govil[.]online	ZIP delivery infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.