Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

MuddyWater uses SimpleHelp to target Israeli organisations

Part of the MuddyWater story · since 17 Sep 2025

Developinglatest 4 hours ago29 articles10 outlets
17 Sep · GBHackers first11 Apr20 Jun29 AugNowThis article29th of 29
  • Wed 17 Sep, 13:56 UTC. GBHackers, first report. MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare.
  • Fri 19 Sep, 01:45 UTC. SecurityOnline, its first report on the story. MuddyWater APT Shifts Tactics to Custom Malware.
  • Wed 22 Oct, 18:05 UTC. The Hacker News, its first report on the story. Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign.
  • Wed 22 Oct, 18:05 UTC. Dark Reading, its first report on the story. MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor.
  • Thu 23 Oct, 01:41 UTC. SecurityOnline. Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node.
  • Thu 23 Oct, 07:17 UTC. GBHackers. New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets.
  • Tue 28 Oct, 12:50 UTC. GBHackers. MuddyWater’s Phoenix Backdoor Infects More Than 100 Government Organizations.
  • Tue 2 Dec, 15:50 UTC. Security Affairs, its first report on the story. MuddyWater strikes Israel with advanced MuddyViper malware.
  • Tue 2 Dec, 22:30 UTC. Dark Reading. Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor.
  • Thu 4 Dec, 07:35 UTC. Dark Reading. 'MuddyWater' Hackers Target Israeli Orgs With Retro Game Tactic.
  • Mon 8 Dec, 02:35 UTC. SecurityOnline. Iran-Linked MuddyWater Deploys UDPGangster Backdoor, Using UDP Protocol for Covert C2.
  • Mon 8 Dec, 07:25 UTC. The Hacker News. MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign.
  • Sat 10 Jan, 11:21 UTC. The Hacker News. MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors.
  • Mon 12 Jan, 01:16 UTC. SecurityOnline. RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants.
  • Mon 23 Feb, 08:11 UTC. The Hacker News. Iranian MuddyWater uses AI built Rust backdoor to hit MENA targets.
  • Mon 23 Feb, 21:31 UTC. Dark Reading. Iran linked MuddyWater turns to AI and Telegram C2 targeting MENA.
  • Fri 6 Mar, 11:29 UTC. The Hacker News. MuddyWater hits US banks with Dindoor backdoor via Deno runtime.
  • Fri 6 Mar, 12:00 UTC. SecurityWeek, its first report on the story. MuddyWater uses Dindoor and Fakeset backdoors in US networks.
  • Fri 6 Mar, 15:34 UTC. Infosecurity, its first report on the story. MuddyWater hits firms with Dindoor backdoor; Fakeset linked.
  • Fri 6 Mar, 20:42 UTC. Security Affairs. Iran-linked MuddyWater Unveils Dindoor Backdoor via Deno.
  • Mon 9 Mar, 09:45 UTC. SOCRadar, its first report on the story. Iranian MuddyWater Deploys Dindoor Backdoor Through Deno Runtime.
  • Mon 16 Mar, 22:25 UTC. Unit 42, its first report on the story. Boggy Serpens Threat Assessment.
  • Tue 31 Mar, 14:00 UTC. Ars Technica, its first report on the story. Iran's hackers are on the offensive against the US and Israel.
  • Wed 6 May, 13:32 UTC. SecurityWeek. Iran-linked MuddyWater fakes Chaos ransomware in 2026 breach.
  • Wed 6 May, 14:46 UTC. The Hacker News. MuddyWater hijacks Teams to spread Chaos ransomware false flag.
  • Wed 6 May, 15:21 UTC. Security Affairs. Iranian spies fake Chaos ransomware to steal data via Teams.
  • Tue 26 May, 16:51 UTC. The Hacker News. MuddyWater Uses DLL Side Loading in Nine Nation Espionage.
  • Wed 24 Jun, 12:20 UTC. Infosecurity. Iranian MuddyWater disguises espionage as ransomware attacks.
  • Thu 5 Nov, 09:00 UTC. SecurityOnline. MuddyWater uses SimpleHelp to target Israeli organisations. This article, 29th of 29.

Threat researchers report a MuddyWater operation using the SimpleHelp remote access tool to target Israeli organisations, with activity traced to September 2026. In the campaign, phishing emails impersonate the Israel Tax Authority and direct finance staff to lookalike government portals. Deceptive domains such as document-govil[.]com were registered to resemble official portals, though researchers note that the string govil is part of a separately registered domain and does not indicate government affiliation.

After victims reach the fraudulent site, a verification page asks for the password 123123, then prompts the download of an archive named Israel_Tax_Authority.zip or document.zip. Inside, the executable document.exe is a masked SimpleHelp installer configured to contact an external server at 129.121.120[.]121, giving attackers remote access capabilities.

Cato CTRL attributes the intrusion to the Iranian threat group MuddyWater, with moderate confidence, and notes that SimpleHelp is a legitimate remote-management tool, which the attackers abuse to gain interactive access, remote desktop control, terminal execution, and file transfer. The campaign leverages social engineering rather than a flaw in SimpleHelp; eight service records linked to the attacker’s central IP were uncovered via FOFA search for HTTP ETag signatures.

SimpleHelp has confirmed the installers used version 5.4.5 and cooperated with researchers to review the infrastructure. Security telemetry from Cato Networks reported automated protections blocking communications to the attacker domains before a remote session could be established. The activity is linked to broader tax-themed phishing observed by Israeli and regional threat intelligence, with corroboration from CyberIL, Group-IB and HarfangLab.

How the story developed

All 29 articles
Developinglatest 4 hours ago29 articles10 outlets

29 articles from 10 outlets since 17 Sep. Picked up again today after 19 weeks quiet. This was the 29th report, 414 days after the first.

Now17 Sep221929218282314221828First reportGBHackers · 17 Sep, 13:56This article29th of 29 · day 414Picked up againafter 5 weeks quiet
  • Wed 17 Sep, 13:56 UTC. GBHackers, first report. MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare.
  • Fri 19 Sep, 01:45 UTC. SecurityOnline, its first report on the story. MuddyWater APT Shifts Tactics to Custom Malware.
  • Wed 22 Oct, 18:05 UTC. The Hacker News, its first report on the story. Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign.
  • Wed 22 Oct, 18:05 UTC. Dark Reading, its first report on the story. MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor.
  • Thu 23 Oct, 01:41 UTC. SecurityOnline. Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node.
  • Thu 23 Oct, 07:17 UTC. GBHackers. New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets.
  • Tue 28 Oct, 12:50 UTC. GBHackers. MuddyWater’s Phoenix Backdoor Infects More Than 100 Government Organizations.
  • Tue 2 Dec, 15:50 UTC. Security Affairs, its first report on the story. MuddyWater strikes Israel with advanced MuddyViper malware.
  • Tue 2 Dec, 22:30 UTC. Dark Reading. Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor.
  • Thu 4 Dec, 07:35 UTC. Dark Reading. 'MuddyWater' Hackers Target Israeli Orgs With Retro Game Tactic.
  • Mon 8 Dec, 02:35 UTC. SecurityOnline. Iran-Linked MuddyWater Deploys UDPGangster Backdoor, Using UDP Protocol for Covert C2.
  • Mon 8 Dec, 07:25 UTC. The Hacker News. MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign.
  • Sat 10 Jan, 11:21 UTC. The Hacker News. MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors.
  • Mon 12 Jan, 01:16 UTC. SecurityOnline. RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants.
  • Mon 23 Feb, 08:11 UTC. The Hacker News. Iranian MuddyWater uses AI built Rust backdoor to hit MENA targets.
  • Mon 23 Feb, 21:31 UTC. Dark Reading. Iran linked MuddyWater turns to AI and Telegram C2 targeting MENA.
  • Fri 6 Mar, 11:29 UTC. The Hacker News. MuddyWater hits US banks with Dindoor backdoor via Deno runtime.
  • Fri 6 Mar, 12:00 UTC. SecurityWeek, its first report on the story. MuddyWater uses Dindoor and Fakeset backdoors in US networks.
  • Fri 6 Mar, 15:34 UTC. Infosecurity, its first report on the story. MuddyWater hits firms with Dindoor backdoor; Fakeset linked.
  • Fri 6 Mar, 20:42 UTC. Security Affairs. Iran-linked MuddyWater Unveils Dindoor Backdoor via Deno.
  • Mon 9 Mar, 09:45 UTC. SOCRadar, its first report on the story. Iranian MuddyWater Deploys Dindoor Backdoor Through Deno Runtime.
  • Mon 16 Mar, 22:25 UTC. Unit 42, its first report on the story. Boggy Serpens Threat Assessment.
  • Tue 31 Mar, 14:00 UTC. Ars Technica, its first report on the story. Iran's hackers are on the offensive against the US and Israel.
  • Wed 6 May, 13:32 UTC. SecurityWeek. Iran-linked MuddyWater fakes Chaos ransomware in 2026 breach.
  • Wed 6 May, 14:46 UTC. The Hacker News. MuddyWater hijacks Teams to spread Chaos ransomware false flag.
  • Wed 6 May, 15:21 UTC. Security Affairs. Iranian spies fake Chaos ransomware to steal data via Teams.
  • Tue 26 May, 16:51 UTC. The Hacker News. MuddyWater Uses DLL Side Loading in Nine Nation Espionage.
  • Wed 24 Jun, 12:20 UTC. Infosecurity. Iranian MuddyWater disguises espionage as ransomware attacks.
  • Thu 5 Nov, 09:00 UTC. SecurityOnline. MuddyWater uses SimpleHelp to target Israeli organisations. This article, 29th of 29.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Wed 17 SepDay 01
    1. MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare13:56 · GBHackers · First report
  2. Fri 19 SepDay 21
    1. MuddyWater APT Shifts Tactics to Custom Malware01:45 · SecurityOnline

  3. Quiet for 5 weeks

    Wed 22 OctDay 352
    1. Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign18:05 · The Hacker News · Picked up again
    2. MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor18:05 · Dark Reading
  4. Thu 23 OctDay 362
    1. Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node01:41 · SecurityOnline
    2. New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets07:17 · GBHackers

  5. Quiet for 5 days

    Tue 28 OctDay 411
    1. MuddyWater’s Phoenix Backdoor Infects More Than 100 Government Organizations12:50 · GBHackers · Picked up again

  6. Quiet for 5 weeks

    Tue 2 DecDay 762
    1. MuddyWater strikes Israel with advanced MuddyViper malware15:50 · Security Affairs · Picked up again
    2. Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor22:30 · Dark Reading
  7. Thu 4 DecDay 781
    1. 'MuddyWater' Hackers Target Israeli Orgs With Retro Game Tactic07:35 · Dark Reading

  8. Quiet for 4 days

    Mon 8 DecDay 822
    1. Iran-Linked MuddyWater Deploys UDPGangster Backdoor, Using UDP Protocol for Covert C202:35 · SecurityOnline · Picked up again
    2. MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign07:25 · The Hacker News

  9. Quiet for 5 weeks

    Sat 10 JanDay 1151
    1. MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors11:21 · The Hacker News · Picked up again

  10. Quiet for 2 days

    Mon 12 JanDay 1171
    1. RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants01:16 · SecurityOnline

  11. Quiet for 6 weeks

    Mon 23 FebDay 1592
    1. Iranian MuddyWater uses AI built Rust backdoor to hit MENA targets08:11 · The Hacker News · Picked up again
    2. Iran linked MuddyWater turns to AI and Telegram C2 targeting MENA21:31 · Dark Reading

  12. Quiet for 11 days

    Fri 6 MarDay 1704
    1. MuddyWater hits US banks with Dindoor backdoor via Deno runtime11:29 · The Hacker News · Picked up again
    2. MuddyWater uses Dindoor and Fakeset backdoors in US networks12:00 · SecurityWeek
    3. MuddyWater hits firms with Dindoor backdoor; Fakeset linked15:34 · Infosecurity
    4. Iran-linked MuddyWater Unveils Dindoor Backdoor via Deno20:42 · Security Affairs

  13. Quiet for 3 days

    Mon 9 MarDay 1731
    1. Iranian MuddyWater Deploys Dindoor Backdoor Through Deno Runtime09:45 · SOCRadar · Picked up again

  14. Quiet for 8 days

    Mon 16 MarDay 1801
    1. Boggy Serpens Threat Assessment22:25 · Unit 42 · Picked up again

  15. Quiet for 2 weeks

    Tue 31 MarDay 1951
    1. Iran's hackers are on the offensive against the US and Israel14:00 · Ars Technica · Picked up again

  16. Quiet for 5 weeks

    Wed 6 MayDay 2313
    1. Iran-linked MuddyWater fakes Chaos ransomware in 2026 breach13:32 · SecurityWeek · Picked up again
    2. MuddyWater hijacks Teams to spread Chaos ransomware false flag14:46 · The Hacker News
    3. Iranian spies fake Chaos ransomware to steal data via Teams15:21 · Security Affairs

  17. Quiet for 3 weeks

    Tue 26 MayDay 2511
    1. MuddyWater Uses DLL Side Loading in Nine Nation Espionage16:51 · The Hacker News · Picked up again

  18. Quiet for 4 weeks

    Wed 24 JunDay 2801
    1. Iranian MuddyWater disguises espionage as ransomware attacks12:20 · Infosecurity · Picked up again

  19. Quiet for 19 weeks

    Thu 5 NovDay 4141
    1. MuddyWater uses SimpleHelp to target Israeli organisations09:00 · SecurityOnline · Picked up again · This article, 29th of 29

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in