{"url":"https://newsforagent.com/news/2026-11-03/cato-networks-muddywater-tax-authority-phishing","markdown_url":"https://newsforagent.com/news/2026-11-03/cato-networks-muddywater-tax-authority-phishing.md","title":"Cato Networks Flags Suspected MuddyWater Tax Authority Phishing","headline":"Cato Networks Ties Israel Tax Authority Phishing Lures to Suspected MuddyWater Activity","description":"Cato Networks traced a phishing campaign impersonating the Israel Tax Authority since September 2026.","section":"Research & Clinical Trials","published_at":"2026-11-03T13:39:10+00:00","modified_at":"2026-11-03T13:39:10+00:00","author":"News Desk","key_takeaways":["Cato Networks observed a phishing campaign impersonating the Israel Tax Authority targeting Israeli organizations since September 2026.","The campaign delivers ZIP archives containing SimpleHelp executables, including one named רשות המסים בישראל.exe.","Cato reported the campaign and SimpleHelp abuse to SimpleHelp on October 20, 2026, and shared its server list the next day."],"companies":[{"name":"Cato Networks","is_primary":true,"profile_url":"https://akta.pro/company-profiles/00002ok/cato-networks","website":"http://www.catonetworks.com"},{"name":"SimpleHelp","is_primary":false,"profile_url":"https://akta.pro/company-profiles/0008yot/simplehelp","website":"https://simple-help.com"}],"source":{"publisher":"Catonetworks","title":"Cato CTRL Research on Suspected Iranian MuddyWater Activity Using Israel Tax Authority Lures and SimpleHelp","url":"https://www.catonetworks.com/blog/cato-ctrl-research-suspected-iranian-muddywater-activity-using-israel-tax-authority-lures-simplehelp/"},"other_sources":[],"tags":["Research & Clinical Trials","Cato Networks","SimpleHelp"],"body_markdown":"[Cato Networks](https://akta.pro/company-profiles/00002ok/cato-networks) said it investigated a phishing campaign impersonating the Israel Tax Authority that has targeted Israeli organizations since September 2026, delivering ZIP archives containing SimpleHelp executables disguised as tax documents. The findings were published by [Catonetworks](https://www.catonetworks.com/blog/cato-ctrl-research-suspected-iranian-muddywater-activity-using-israel-tax-authority-lures-simplehelp/). Cato suspects MuddyWater involvement.\n\n## How the Israel Tax Authority Lure Delivered SimpleHelp\n\nThe attack begins with a phishing email impersonating the Israel Tax Authority. Recipients trying to reach a supposed personal area are sent to a lookalike site and asked to complete a CAPTCHA-style verification step before downloading a ZIP archive. The infrastructure uses names such as document-govil[.]com to resemble the official gov.il namespace; the string govil belongs to a separately registered domain and does not indicate government affiliation.\n\nThe verification page shows a checkbox, a Continue button and the password 123123. The archive is presented as a tax-related file, with Israel_Tax_Authority.zip appearing in browser download history and a second archive named document.zip also identified. Inside, the executable is named רשות המסים בישראל.exe, meaning \"Israel Tax Authority,\" and the payload inventory also includes document.exe.\n\n[SimpleHelp](https://akta.pro/company-profiles/0008yot/simplehelp) is legitimate remote support software, and the campaign uses it as the remote-access component behind the document lure. Cato identified 129.121.120[.]121 as associated command-and-control infrastructure. Cato telemetry recorded a threat prevention alert against the campaign's web infrastructure, an event that demonstrates prevention of that request without establishing a completed remote-access session.\n\n## Cato's Attribution to MuddyWater\n\nCato said it suspects MuddyWater based on the combination of targeting Israeli organizations, locally tailored authority impersonation and delivery of legitimate remote-access software through phishing. The company cited Group-IB's earlier documentation of MuddyWater's use of SimpleHelp as context for the assessment, and HarfangLab's record of an October 2023 MuddyWater phishing email linking to a SimpleHelp installer.\n\n\"Based on the evidence reviewed and validation with SimpleHelp, we did not identify exploitation of a SimpleHelp vulnerability or compromise of SimpleHelp's own infrastructure in connection with this campaign,\" Cato wrote, according to akta.pro [company records](https://akta.pro/company-data). SimpleHelp identified both samples as Remote Access Client version 5.4.5 and assessed the activity as apparent malicious use of an older release, stating it had not seen evidence indicating exploitation of a SimpleHelp vulnerability.\n\n## Earlier Cato Threat Research\n\nCato's cloud-delivered IPS blocked PHP2Shell exploitation attempts on inspected traffic, with no external requests from October 17 to 20 and first attempts on October 21, according to Catonetworks. Cato's AI-native SASE platform generated IPS signatures for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 in minutes after PHP released fixes, Catonetworks said on October 22.\n\nCERT-FR's October 13 update reported compromises of refrigeration controllers, including Danfoss AK-SM and Copeland XWEB systems, with entry methods unconfirmed, Catonetworks said on October 26. Cato added IPS signatures for publicly disclosed Danfoss vulnerabilities and continues monitoring for new exploits.\n\n## SimpleHelp Disclosure Timeline\n\nCato reported the campaign and associated SimpleHelp abuse to SimpleHelp on October 20, 2026. SimpleHelp identified both samples as Remote Access Client version 5.4.5 that day, reported no evidence of vulnerability exploitation in the information provided and requested infrastructure details to investigate. Cato shared the relevant server list with SimpleHelp on October 21, 2026.\n","publisher":{"name":"News for Agent","url":"https://newsforagent.com"}}