---
title: Hunt: suspected MuddyWater campaign impersonates the Israel Tax Authority to install SimpleHelp RMM (domains, IPs, hashes) | ctxsec
url: https://ctxsec.com/items/hunt-cato-ctrl-muddywater-israel-tax-authority-simplehelp-iocs
description: "Cato CTRL says a campaign seen since September 2026 sends Israeli organizations phishing emails posing as the Israel Tax Authority. Lookalike 'govil' domains show a CAPTCHA-style page with the password 123123, then serve ZIPs (Israel_Tax_Authority.zip, document.zip) holding a SimpleHelp Remote Access Client 5.4.5 executable disguised as a tax document. Cato suspects MuddyWater based on targeting and the group's past use of SimpleHelp and similar RMM tools. SimpleHelp found no vulnerability exploitation; this is social engineering plus abuse of a legitimate tool."
status: "confirmed research (Cato CTRL, Nov 3; MuddyWater attribution 'suspected')"
published: 2026-11-04
---

> Cato CTRL says a campaign seen since September 2026 sends Israeli organizations phishing emails posing as the Israel Tax Authority. Lookalike 'govil' domains show a CAPTCHA-style page with the password 123123, then serve ZIPs (Israel_Tax_Authority.zip, document.zip) holding a SimpleHelp Remote Access Client 5.4.5 executable disguised as a tax document. Cato suspects MuddyWater based on targeting and the group's past use of SimpleHelp and similar RMM tools. SimpleHelp found no vulnerability exploitation; this is social engineering plus abuse of a legitimate tool.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cato-ctrl-muddywater-israel-tax-authority-simplehelp-iocs.md)

confirmed research (Cato CTRL, Nov 3; MuddyWater attribution 'suspected')

2026-11-04

### Hunt: suspected MuddyWater campaign impersonates the Israel Tax Authority to install SimpleHelp RMM (domains, IPs, hashes)

- **Domains:** `doc-taxes-govil[.]org`, `document-govil[.]com`, `doc26-govil[.]org`, `document-govil[.]online`, `docs[.]templateoption[.]com/Form`.
- **IPs:** `129.121.120[.]121` (C2), `169.58.239[.]210`, `161.97.138[.]129` (abused SimpleHelp servers).
- **SHA-256:** document.zip `0d881ad82ddf4ccdb18c899572405dddc0adc2e6d351f8531881bf736760b0c2`; document.exe `f018003432114393db3bd27a4f02e772a316078a80949f306c41fb397b219c6d`; Israel_Tax_Authority.zip `6ba34f275f27a2584c7d653f83a8bb9a8c48ef3ae19491cb796cc56b75106f88`; Hebrew-named .exe `62a25285436c5e34a42661345ccbcd3fe7d96d74991a7fc37846cc9342ba39ff`.
- **Hunt:** look for SimpleHelp client installs or services (Remote Access Service) you didn't deploy, especially started from a user's Downloads folder or a ZIP-extracted path, and for outbound connections to SimpleHelp servers you don't operate. Block or allowlist RMM tools by publisher and approved server.

Sources: [Cato CTRL: Suspected Iranian MuddyWater activity using Israel Tax Authority lures and SimpleHelp (Nov 3)](https://www.catonetworks.com/blog/cato-ctrl-research-suspected-iranian-muddywater-activity-using-israel-tax-authority-lures-simplehelp/)