Skip to navigation

Threat reportPhishingTL-2026-5300

Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations

highACTIVE

Phishing emails impersonating the Israel Tax Authority lead victims to lookalike govil domains with CAPTCHA-style verification pages that serve malicious ZIP archives, resulting in installation of the legitimate SimpleHelp remote monitoring tool for remote access. The campaign has been active since September 2026 and is suspected, but not confirmed, to be MuddyWater (Iran MOIS-linked) activity.

Key facts for MuddyWater SimpleHelp phishing

IdentifiersTL-2026-5300
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsSimpleHelp SimpleHelp Remote Access client (legitimate tool abused; no vulnerability exploited)
AttributionMuddyWater (low confidence)
Nation-state nexusIran
ToolsSimpleHelp
MITRE ATT&CK techniquesT1036.005 Match Legitimate Resource Name or Location, T1204.001 User Execution, T1204.002 Malicious File, T1219 Remote Access Tools, T1219.002 Remote Access Tools, T1566.002 Spearphishing Link, T1583.001 Domains, T1598.003 Spearphishing Link, T1608.001 Stage Capabilities
MotivationESPIONAGE
Target sectorsfinance, accounting, government administration, multi-sector
Target regionsisrael
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for MuddyWater SimpleHelp phishing

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5300 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MuddyWater-Suspected Israel Tax Authority Lookalike govil Domain Contact (SimpleHelp Lure) - Exploitation

Detects endpoint DNS lookups or connections to the four reported Israel Tax Authority lookalike domains (document-govil.com, doc-taxes-govil.org, doc26-govil.org, document-govil.online), the reported infrastructure IP 129.121.120.121, and any new host matching the govil lookalike naming pattern. These pages serve a CAPTCHA-style gate and a password-protected ZIP that delivers the legitimate SimpleHelp RMM client. Attribution to MuddyWater is suspected and unconfirmed; the detection keys on behaviour and infrastructure, not attribution.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.002, T1583.001, T1598.003
  • Data sources: sysmon, dns_query, edr_network
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=22 OR EventCode=3) earliest=-24h
| eval dest_name=lower(coalesce(QueryName, DestinationHostname, DestinationIp))
| eval dest_ip=DestinationIp
| eval pattern_match=if(match(dest_name,"(^|[.])(doc|document|documents|tax|taxes)[a-z0-9-]*govil[.](com|org|online|net|info)$"),1,0)
| where pattern_match=1 OR in(dest_name,"document-govil.com","doc-taxes-govil.org","doc26-govil.org","document-govil.online") OR dest_ip="129.121.120.121"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as processes values(dest_ip) as dest_ips by host dest_name
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lureDomains = dynamic(["document-govil.com","doc-taxes-govil.org","doc26-govil.org","document-govil.online"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (lureDomains) or RemoteIP == "129.121.120.121" or RemoteUrl matches regex @"(?i)(^|[./])(doc|document|documents|tax|taxes)[a-z0-9-]*govil\.(com|org|online|net|info)(/|:|$)"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by Timestamp desc

Sigma

title: Israel Tax Authority Lookalike govil Domain DNS Query
id: 7c1f3a52-0b8e-4d6a-9e21-5a3c8d4f1b01
status: experimental
description: Detects DNS queries to reported Israel Tax Authority lookalike domains used to deliver a password-protected ZIP containing the legitimate SimpleHelp RMM client.
references:
    - https://www.catonetworks.com/blog/cato-ctrl-research-suspected-iranian-muddywater-activity-using-israel-tax-authority-lures-simplehelp/
    - https://gbhackers.com/fake-tax-authority-emails/
    - https://www.group-ib.com/blog/muddywater-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.resource-development
    - attack.t1583.001
    - attack.reconnaissance
    - attack.t1598.003
    - attack.tool.simplehelp
    - attack.g0069
logsource:
    category: dns_query
    product: windows
detection:
    selection_ioc:
        QueryName|endswith:
            - 'document-govil.com'
            - 'doc-taxes-govil.org'
            - 'doc26-govil.org'
            - 'document-govil.online'
    selection_pattern:
        QueryName|re: '(?i)(^|\.)(doc|document|documents|tax|taxes)[a-z0-9-]*govil\.(com|org|online|net|info)$'
    condition: 1 of selection_*
falsepositives:
    - Security awareness simulations or takedown research using these domains
level: high

Known false positives:

  • Security team phishing simulations or sandbox/takedown analysis touching the domains
  • Threat-intel enrichment tools resolving the domains

Tuning notes: Extend the domain list from new Cato/GBHackers reporting. The regex deliberately excludes the genuine gov.il namespace. Feed proxy/DNS-resolver logs into the same logic if Sysmon EventCode 22 is not deployed. Block the matches at DNS and proxy.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Israel Tax Authority Lure Archive Download ([indicator] / [indicator]) - Exploitation · unlock with TL Creds
  • Unsanctioned SimpleHelp Remote Access Client Execution (Any Filename) - Post-Exploitation · unlock with TL Creds
  • Command Interpreter Spawned by SimpleHelp Service (Terminal / Toolbox Script Execution) - C2 · unlock with TL Creds
  • Executable Launched Directly From Archive Extraction Path (Lure ZIP Execution) - Exploitation · unlock with TL Creds
  • SimpleHelp Remote Access Service Installed (JWrapper Service Persistence) - Post-Exploitation · unlock with TL Creds
  • Outbound Connections From SimpleHelp Client Binaries to Public Hosts - C2 · unlock with TL Creds
  • SimpleHelp Client Masquerading as Tax Document ([indicator] / Hebrew Israel Tax Authority Name) - Post-Exploitation · unlock with TL Creds
  • Connection to Reported SimpleHelp Infrastructure ([indicator] and Historical MuddyWater SimpleHelp Servers) - C2 · unlock with TL Creds

Indicators of compromise for MuddyWater SimpleHelp phishing

As of 2026-11-05, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5300.

Sample indicators (3 of 23)

  • IP address: 129.121.120[.]121
  • Domain: document-govil[.]com
  • File hash: 53ce7a2850e27465f3aae3cc2fae1a3ec1b6a640

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

23 indicators of compromise · unlock with TL Creds. Compare plans

How MuddyWater SimpleHelp phishing works

Cato CTRL research, as summarized by GBHackers on 2026-11-05, describes a phishing campaign active since September 2026 that targets Israeli organizations, particularly finance, accounting and administrative personnel who handle tax administration workflows. Emails impersonate the Israel Tax Authority and direct recipients to lookalike domains (document-govil[.]com, doc-taxes-govil[.]org, doc26-govil[.]org, document-govil[.]online). The landing pages present a CAPTCHA-style verification step that supplies a password (reported as 123123) for the download, which frames the archive as a legitimate government document.

The victim downloads a ZIP archive (Israel_Tax_Authority.zip or document.zip) containing an executable (document.exe or a Hebrew-named file meaning 'Israel Tax Authority') that is the legitimate SimpleHelp remote access client. No SimpleHelp vulnerability exploitation and no compromise of SimpleHelp's own infrastructure was identified; the chain relies on user execution. If the user launches the executable and the associated SimpleHelp service starts, the operator gains desktop control, terminal access, file transfer, system diagnostics and the Toolbox feature for repeatable commands, scripts and resource delivery. The report stresses that downloading the archive alone does not establish compromise, and that launching the standard Remote Access executable differs from the service actually starting.

Infrastructure notes: the domains served nginx 'Coming Soon' pages, and two HTTP ETag values pivoted to eight service records linked to the address 129.121.120.121 (the specific ETag values were not disclosed). Cato telemetry recorded one threat-prevention alert, which does not demonstrate successful payload execution.

Attribution to MuddyWater is suspected and explicitly unconfirmed. It rests on historical tradecraft: Group-IB documented MuddyWater operating legitimate SimpleHelp clients and servers from June 2022 (published April 2023); HarfangLab documented similar SimpleHelp phishing in October 2023; Proofpoint reported Hebrew payroll-themed attacks in March 2024; and a February 2022 joint government advisory identified MuddyWater as subordinate to Iran's Ministry of Intelligence and Security. This history does not independently prove responsibility for this campaign. Note that this record is based on the GBHackers article; the Cato primary report could not be retrieved at research time.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1204.001 User Execution; T1204.002 Malicious File

Command and Control

T1219 Remote Access Tools; T1219.002 Remote Access Tools

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1608.001 Stage Capabilities

Reconnaissance

T1598.003 Spearphishing Link

Remediation for MuddyWater SimpleHelp phishing

Immediate actions

  • Block the four lookalike domains and IP 129.121.120.121 at DNS, proxy and perimeter
  • Search mail and web logs for Israel Tax Authority themed messages and visits to the govil lookalike domains
  • Hunt endpoints for SimpleHelp client executables and services not deployed by IT, including document.exe and the Hebrew-named executable
  • Isolate hosts where a SimpleHelp service is running and was not sanctioned, and reset credentials used on them

Workarounds

  • Block downloads of password-protected ZIP archives from newly registered or lookalike domains at the web gateway
  • Block outbound connections to unsanctioned SimpleHelp servers at the network edge

Longer-term hardening

  • Allowlist approved remote monitoring and management tools and alert on unsanctioned RMM installs
  • Train finance and accounting staff to verify tax authority communications through official channels, and to treat password-protected archives from web pages as suspicious
  • Restrict execution of unsigned or user-downloaded executables from archive extraction paths such as Downloads and temp directories

Affected and fixed versions

  • SimpleHelp — SimpleHelp Remote Access client (legitimate tool abused; no vulnerability exploited)

Timeline of MuddyWater SimpleHelp phishing

Last updated · revalidated 1× · latest source

  • Joint government advisory (February 2022) identifies locked-ioc-23 as subordinate to Iran's Ministry of Intelligence and Security
  • Group-IB records first detected locked-ioc-23 use of locked-ioc-22 clients/servers (signed locked-ioc-22 executable uploaded to VirusTotal)
  • Group-IB publishes locked-ioc-23 infrastructure research identifying at least eight locked-ioc-22 servers
  • HarfangLab documents similar locked-ioc-22 phishing (October 2023; exact day not stated)
  • Proofpoint reports Hebrew payroll-themed attacks (March 2024; exact day not stated)
  • locked-ioc-9 themed phishing campaign delivering locked-ioc-22 begins (September 2026; exact day not stated)
  • Cato researchers notify locked-ioc-22 of the abuse.
  • Cato shares attacker infrastructure details with locked-ioc-22.
  • Cato CTRL publishes its research on the fake locked-ioc-9 sites and CAPTCHA checks delivering locked-ioc-22, noting a suspected but inconclusive locked-ioc-23 link.
  • GBHackers reports Cato CTRL findings: suspected, unconfirmed locked-ioc-23 activity targeting Israeli organizations

Update history

Sources cited for MuddyWater SimpleHelp phishing

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats