New Iranian-Linked Cyberattack Targets Israelis Via Fake Tax Authority Emails
Translated & summarized from Cursorinfo by baba
Hackers, potentially linked to Iran, are targeting Israeli organizations with a new phishing campaign impersonating the Israeli Tax Authority. The attacks, discovered by Cato Networks, use fake emails to trick employees into downloading remote access malware. Researchers suspect the MuddyWater group is responsible, based on similar past tactics, though this remains unconfirmed. The campaign exploits trust in official communications, and while the full extent of the breach is unknown, experts warn of the risks.
The story in 6 lines · by baba
- Hackers linked to Iran are targeting Israeli organizations with fake tax authority emails.
- The phishing campaign aims to trick employees into downloading remote access malware.
- Researchers suspect the MuddyWater hacking group is behind the attacks.
- The campaign uses fake websites that mimic the official Israeli Tax Authority portal.
- The malware installs legitimate remote access software for malicious purposes.
- The full extent of the cyberattack's success remains unconfirmed.
A new wave of cyberattacks, suspected to be orchestrated by Iran-linked hackers, is targeting Israeli organizations by impersonating the Israeli Tax Authority. Researchers at Cato CTRL, a division of Cato Networks, discovered the campaign, which began in September 2023. The attackers send fraudulent emails to employees, urging them to download malicious software disguised as tax-related documents. These emails link to fake government websites that mimic the official tax authority portal, prompting users to undergo security checks and download files. Instead of legitimate documents, users download executable files, such as one named "Israel Tax Authority.exe," which installs remote access software like SimpleHelp.
This software, though legitimate for remote support, can be exploited by attackers to gain unauthorized access to employee computers, allowing them to view information, run applications, execute commands, and transfer files. The attackers may also be able to reconnect to compromised systems without user intervention. Researchers suspect the hacking group MuddyWater, associated with Iran's Ministry of Intelligence and Security, is behind the attacks, citing similarities to previous operations including the use of Hebrew phishing messages and legitimate remote access tools.
MuddyWater has previously used similar tactics, including distributing SimpleHelp in October 2023 and sending fake salary-related emails in March 2024. However, Cato Networks emphasizes that MuddyWater's involvement is currently an assumption based on technical indicators and methods, not definitive proof. The developers of SimpleHelp have confirmed that components of an older version of their software were found in the malicious files but found no evidence of breaches in their own systems.
Cato Networks identified several sites distributing the suspicious files and command-and-control servers, and their security system blocked one related web address. The exact number of affected organizations and employees is unknown, and there is no confirmation that attackers successfully gained control of any victim computers. The researchers highlighted the danger of such phishing attacks, which exploit employee trust in official communications, and advised caution when encountering requests to visit external sites or download files.
Mentioned
The same event, reported separately by each outlet. Open a few to compare what different newsrooms emphasize — and what they leave out.
Centre 1Other 1
Not the same event — other stories that share this one’s people, places, or theme: background, reactions, and follow-ups.
