MuddyWater Suspected in Fake Tax Authority Phishing Campaign
Original title: MuddyWater Hackers Suspected of Targeting Israeli Organizations With Fake Tax Authority Emails
MuddyWater suspected of targeting Israeli organizations with tax-themed phishing emails leading to SimpleHelp remote access installation.
Israeli organizations have faced phishing emails impersonating the Israel Tax Authority since September 2026. Messages direct recipients to fake tax document download sites using government-themed domains. Executables deliver SimpleHelp remote monitoring software configured for attacker control. Attribution to MuddyWater remains unconfirmed despite historical use of similar legitimate RMM tools. No software vulnerabilities were exploited in this social engineering campaign.
Unconfirmed: Attribution to MuddyWater remains unconfirmed
- Campaign since September 2026
- SimpleHelp RMM installed
- Fake gov.il domains used
- Hebrew tax documents
- Unconfirmed MuddyWater link
Impact: Remote access to compromised systems
- 1.Do not download attachments from suspicious emails
- 2.Verify sender domains independently
- 3.Report phishing to authorities
- Threat actors
- MuddyWater
- Victims
- Israeli organizations
- Countries
- Israel
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | doc26-govil.org | very infrastructure and destination in the Cato Block event doc26-govil[.]org ZIP delivery infrastructure document-govil[.]online ZIP d |
| domain | doc-taxes-govil.org | tors of Compromise Indicator Role in the research inventory doc-taxes-govil[.]org ZIP delivery infrastructure document-govil[.]com ZIP deli |
| domain | document-govil.com | o a lookalike website. Government-themed domains, including document-govil[.]com, imitate Israel’s official gov.il namespace. However, “go |
| domain | document-govil.online | linked to that address, including document-govil[.]com and document-govil[.]online. Both domains displayed nginx-served “Coming Soon” pages. |
| ipv4 | 129.121.120.121 | sectors. Fake Tax Authority Emails Investigators associated 129.121.120[.]121 with the campaign’s command-and-control infrastructure. S |
From the original article
3 min read at gbhackers.com
Israeli organizations have been targeted since September 2026 in a phishing campaign impersonating the Israel Tax Authority and distributing SimpleHelp remote monitoring and management software disguised as tax documents. Investigators suspect MuddyWater involvement, citing the targeting and its documented abuse of legitimate remote-access tools, but the attribution remains unconfirmed.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.