# Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations

> Phishing emails impersonating the Israel Tax Authority lead victims to lookalike govil domains with CAPTCHA-style verification pages that serve malicious ZIP archives, resulting in installation of the legitimate SimpleHelp remote monitoring tool for remote access. The campaign has been active since September 2026 and is suspected, but not confirmed, to be MuddyWater (Iran MOIS-linked) activity.

- **Published:** 2026-11-05T05:49:10Z
- **Last reviewed:** 2026-11-05T08:19:14.504Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5300
- **ID:** TL-2026-5300
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)

## Description

Cato CTRL research, as summarized by GBHackers on 2026-11-05, describes a phishing campaign active since September 2026 that targets Israeli organizations, particularly finance, accounting and administrative personnel who handle tax administration workflows. Emails impersonate the Israel Tax Authority and direct recipients to lookalike domains (document-govil[.]com, doc-taxes-govil[.]org, doc26-govil[.]org, document-govil[.]online). The landing pages present a CAPTCHA-style verification step that supplies a password (reported as 123123) for the download, which frames the archive as a legitimate government document.

The victim downloads a ZIP archive (Israel_Tax_Authority.zip or document.zip) containing an executable (document.exe or a Hebrew-named file meaning 'Israel Tax Authority') that is the legitimate SimpleHelp remote access client. No SimpleHelp vulnerability exploitation and no compromise of SimpleHelp's own infrastructure was identified; the chain relies on user execution. If the user launches the executable and the associated SimpleHelp service starts, the operator gains desktop control, terminal access, file transfer, system diagnostics and the Toolbox feature for repeatable commands, scripts and resource delivery. The report stresses that downloading the archive alone does not establish compromise, and that launching the standard Remote Access executable differs from the service actually starting.

Infrastructure notes: the domains served nginx 'Coming Soon' pages, and two HTTP ETag values pivoted to eight service records linked to the address 129.121.120.121 (the specific ETag values were not disclosed). Cato telemetry recorded one threat-prevention alert, which does not demonstrate successful payload execution.

Attribution to MuddyWater is suspected and explicitly unconfirmed. It rests on historical tradecraft: Group-IB documented MuddyWater operating legitimate SimpleHelp clients and servers from June 2022 (published April 2023); HarfangLab documented similar SimpleHelp phishing in October 2023; Proofpoint reported Hebrew payroll-themed attacks in March 2024; and a February 2022 joint government advisory identified MuddyWater as subordinate to Iran's Ministry of Intelligence and Security. This history does not independently prove responsibility for this campaign. Note that this record is based on the GBHackers article; the Cato primary report could not be retrieved at research time.

## MITRE ATT&CK

- T1598.003 Spearphishing Link
- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1219 Remote Access Tools
- T1608.001 Stage Capabilities
- T1204.001 User Execution
- T1219.002 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MuddyWater-Suspected Israel Tax Authority Lookalike govil Domain Contact (SimpleHelp Lure) - Exploitation** (`TL-2026-5300-SPL-001`)

Detects endpoint DNS lookups or connections to the four reported Israel Tax Authority lookalike domains (document-govil.com, doc-taxes-govil.org, doc26-govil.org, document-govil.online), the reported infrastructure IP 129.121.120.121, and any new host matching the govil lookalike naming pattern. These pages serve a CAPTCHA-style gate and a password-protected ZIP that delivers the legitimate SimpleHelp RMM client. Attribution to MuddyWater is suspected and unconfirmed; the detection keys on behaviour and infrastructure, not attribution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1583.001, T1598.003
- **Data sources:** sysmon, dns_query, edr_network
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=22 OR EventCode=3) earliest=-24h
| eval dest_name=lower(coalesce(QueryName, DestinationHostname, DestinationIp))
| eval dest_ip=DestinationIp
| eval pattern_match=if(match(dest_name,"(^|[.])(doc|document|documents|tax|taxes)[a-z0-9-]*govil[.](com|org|online|net|info)$"),1,0)
| where pattern_match=1 OR in(dest_name,"document-govil.com","doc-taxes-govil.org","doc26-govil.org","document-govil.online") OR dest_ip="129.121.120.121"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as processes values(dest_ip) as dest_ips by host dest_name
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lureDomains = dynamic(["document-govil.com","doc-taxes-govil.org","doc26-govil.org","document-govil.online"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (lureDomains) or RemoteIP == "129.121.120.121" or RemoteUrl matches regex @"(?i)(^|[./])(doc|document|documents|tax|taxes)[a-z0-9-]*govil\.(com|org|online|net|info)(/|:|$)"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by Timestamp desc
```

### Sigma

```yaml
title: Israel Tax Authority Lookalike govil Domain DNS Query
id: 7c1f3a52-0b8e-4d6a-9e21-5a3c8d4f1b01
status: experimental
description: Detects DNS queries to reported Israel Tax Authority lookalike domains used to deliver a password-protected ZIP containing the legitimate SimpleHelp RMM client.
references:
    - https://www.catonetworks.com/blog/cato-ctrl-research-suspected-iranian-muddywater-activity-using-israel-tax-authority-lures-simplehelp/
    - https://gbhackers.com/fake-tax-authority-emails/
    - https://www.group-ib.com/blog/muddywater-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.resource-development
    - attack.t1583.001
    - attack.reconnaissance
    - attack.t1598.003
    - attack.tool.simplehelp
    - attack.g0069
logsource:
    category: dns_query
    product: windows
detection:
    selection_ioc:
        QueryName|endswith:
            - 'document-govil.com'
            - 'doc-taxes-govil.org'
            - 'doc26-govil.org'
            - 'document-govil.online'
    selection_pattern:
        QueryName|re: '(?i)(^|\.)(doc|document|documents|tax|taxes)[a-z0-9-]*govil\.(com|org|online|net|info)$'
    condition: 1 of selection_*
falsepositives:
    - Security awareness simulations or takedown research using these domains
level: high

```

**Known false positives:**

- Security team phishing simulations or sandbox/takedown analysis touching the domains
- Threat-intel enrichment tools resolving the domains

**Tuning notes:** Extend the domain list from new Cato/GBHackers reporting. The regex deliberately excludes the genuine gov.il namespace. Feed proxy/DNS-resolver logs into the same logic if Sysmon EventCode 22 is not deployed. Block the matches at DNS and proxy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Israel Tax Authority Lure Archive Download ([indicator] / [indicator]) - Exploitation (locked: unlock with TL Creds)
- Unsanctioned SimpleHelp Remote Access Client Execution (Any Filename) - Post-Exploitation (locked: unlock with TL Creds)
- Command Interpreter Spawned by SimpleHelp Service (Terminal / Toolbox Script Execution) - C2 (locked: unlock with TL Creds)
- Executable Launched Directly From Archive Extraction Path (Lure ZIP Execution) - Exploitation (locked: unlock with TL Creds)
- SimpleHelp Remote Access Service Installed (JWrapper Service Persistence) - Post-Exploitation (locked: unlock with TL Creds)
- Outbound Connections From SimpleHelp Client Binaries to Public Hosts - C2 (locked: unlock with TL Creds)
- SimpleHelp Client Masquerading as Tax Document ([indicator] / Hebrew Israel Tax Authority Name) - Post-Exploitation (locked: unlock with TL Creds)
- Connection to Reported SimpleHelp Infrastructure ([indicator] and Historical MuddyWater SimpleHelp Servers) - C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `129.121.120[.]121`
- Domain: `document-govil[.]com`
- File hash: `53ce7a2850e27465f3aae3cc2fae1a3ec1b6a640`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [MuddyWater Hackers Suspected of Targeting Israeli Organizations With Fake Tax Authority Emails (GBHackers)](https://gbhackers.com/fake-tax-authority-emails/)
- [Cato CTRL Research: Suspected Iranian MuddyWater Activity Using Israel Tax Authority Lures and SimpleHelp](https://www.catonetworks.com/blog/cato-ctrl-research-suspected-iranian-muddywater-activity-using-israel-tax-authority-lures-simplehelp/)
- [Group-IB: MuddyWater Infrastructure (SimpleHelp servers and clients)](https://www.group-ib.com/blog/muddywater-infrastructure/)
- [CISA/FBI/CNMF/NCSC-UK/NSA: Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations (AA22-055A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)
- [The Hacker News: Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access](https://thehackernews.com/2023/04/iranian-hackers-using-simplehelp-remote.html)
- [The Hacker News: Iran's MuddyWater Targets Israel in New Spear-Phishing Cyber Campaign](https://thehackernews.com/2023/11/irans-muddywater-targets-israel-in-new.html)
- [CSO Online: Iran cyberespionage group taps SimpleHelp for persistence on victim devices](https://www.csoonline.com/article/3694135/iran-cyberespionage-group-taps-simplehelp-for-persistence-on-victim-devices.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5300