Fake Israel Tax Authority lures deliver SimpleHelp remote access software
- Severity
- High
- Sources
- 1
What happened
A social engineering campaign impersonates the Israel Tax Authority using lookalike government-themed domains and a fake verification page with an archive password, delivering a ZIP containing a Hebrew-named executable that deploys SimpleHelp Remote Access Client 5.4.5 configured to attacker infrastructure. Cato Networks reports the activity, with tentative MuddyWater attribution based on targeting and prior SimpleHelp use; no vulnerability exploitation was found and SimpleHelp reported the release as malicious use of an older build. Defenders should block the listed domains and IPs (including 129.121.120[.]121, 169.58.239[.]210 and 161.97.138[.]129), hunt for unauthorised SimpleHelp clients, and review use of remote access tools.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Block the listed campaign domains and IP addresses at the network perimeter.
- Search endpoints for unauthorised SimpleHelp remote access clients and investigate any found, including version 5.4.5.
- Warn finance, accounting and administrative staff not to open archives or run executables from unexpected tax authority emails.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products
Government agencies