[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed research (Cato CTRL, Nov 3; MuddyWater attribution 'suspected')

Hunt: suspected MuddyWater campaign impersonates the Israel Tax Authority to install SimpleHelp RMM (domains, IPs, hashes)

  • Domains: doc-taxes-govil[.]org, document-govil[.]com, doc26-govil[.]org, document-govil[.]online, docs[.]templateoption[.]com/Form.
  • IPs: 129.121.120[.]121 (C2), 169.58.239[.]210, 161.97.138[.]129 (abused SimpleHelp servers).
  • SHA-256: document.zip 0d881ad82ddf4ccdb18c899572405dddc0adc2e6d351f8531881bf736760b0c2; document.exe f018003432114393db3bd27a4f02e772a316078a80949f306c41fb397b219c6d; Israel_Tax_Authority.zip 6ba34f275f27a2584c7d653f83a8bb9a8c48ef3ae19491cb796cc56b75106f88; Hebrew-named .exe 62a25285436c5e34a42661345ccbcd3fe7d96d74991a7fc37846cc9342ba39ff.
  • Hunt: look for SimpleHelp client installs or services (Remote Access Service) you didn't deploy, especially started from a user's Downloads folder or a ZIP-extracted path, and for outbound connections to SimpleHelp servers you don't operate. Block or allowlist RMM tools by publisher and approved server.

Sources: Cato CTRL: Suspected Iranian MuddyWater activity using Israel Tax Authority lures and SimpleHelp (Nov 3)