MuddyWater Targets Israeli Businesses in Sophisticated Tax Phishing Campaign
Cato Networks researchers uncover a targeted phishing campaign by the Iranian-linked group MuddyWater, using fake Israel Tax Authority lures and legitimate remote management software to breach corporate endpoints.
Security researchers at Cato Networks' Cato CTRL unit have uncovered a targeted phishing campaign masquerading as the Israel Tax Authority, aimed at businesses and organizations across Israel. Identified in September 2026, the campaign deploys fraudulent emails to finance and administrative personnel, leveraging routine tax matters to breach corporate endpoints with remote administration tools.
Attribution and Social Engineering Tactics
According to the researchers—Dr. Guy Wizel, Idan Trab, Zohar Buber, Tomer Pogiz, and Shani Kurzberg—the operation is attributed to the MuddyWater cyber espionage group, linked to Iran's Ministry of Intelligence and Security. The attack begins with phishing emails urging employees to access their personal government portal to review tax documents.
Clicking the embedded link redirects victims to spoofed domains designed to mimic official government portals, such as document-govil[.]com and document-govil[.]online. To establish a veneer of legitimacy, targets are prompted to complete a mock CAPTCHA verification, enter a predefined password of 123123, and click continue to proceed.
Execution and Deployment of Remote Access Tools
Upon successful verification, the site downloads a compressed archive, such as Israel_Tax_Authority.zip or document.zip. Inside the archive lies an executable file bearing a benign Hebrew title translated as Israel Tax Authority.exe, disguised as a standard tax document.
Rather than deploying bespoke malware, the threat actors weaponize SimpleHelp, a legitimate Remote Monitoring and Management (RMM) software. Running the executable installs an outdated version of the application, version 5.4.5, pre-configured to communicate directly with a command-and-control server operated by the attackers at IP address 129.121.120[.]121. This grants unauthorized full remote access to the compromised workstation, paving the way for lateral movement within the corporate network.
Response and Mitigation
Cato researchers clarified that the campaign exploits the legitimate configuration of SimpleHelp rather than an underlying software vulnerability or a breach of the vendor's infrastructure. SimpleHelp cooperated with the investigation, promptly disabling the implicated servers upon receiving the telemetry.
Security experts emphasize that the tactics align closely with MuddyWater's established operational profile, characterized by localized Hebrew-language lures and the abuse of commercial RMM tools like SimpleHelp and Atera. Organizations are advised to enhance employee vigilance regarding unsolicited emails containing archives or executable files and to enforce network-level blocks on known indicators of compromise.
