Cyber Attack Targets Israeli Organizations Posing as Tax Authority
Cybersecurity firm Cato Networks has exposed a cyberattack targeting Israeli organizations by impersonating the Israel Tax Authority. Hackers are using phishing emails to trick employees into downloading remote access software, potentially linked to an Iranian hacking group. The attack relies on social engineering, aiming to gain unauthorized access to company computers.
הידיעה ב-5 שורות · תקציר של baba
- Hackers are impersonating the Israel Tax Authority in a cyberattack targeting Israeli organizations.
- The attack uses phishing emails to trick employees into downloading remote access software.
- Researchers suspect the Iranian hacking group MuddyWater is behind the sophisticated operation.
- The method relies on social engineering, deceiving users into installing unauthorized software.
- Cato Networks is blocking malicious sites and monitoring for further suspicious activity.
Cybersecurity researchers at Cato Networks have uncovered a sophisticated cyberattack targeting organizations in Israel, where hackers are impersonating the Israel Tax Authority. The attack, first identified in September 2026, involves sending emails that appear to be official communications from the Tax Authority, directing employees to fake websites. The goal is to trick recipients into downloading remote access software disguised as tax-related documents.
These fraudulent websites mimic government portals, aiming to lend credibility to the phishing emails. Employees who click the links are led to a fake portal of the Tax Authority, where they are prompted to complete a security verification process before downloading supposed tax documents. In reality, these files are executable programs, such as one named "Israel Tax Authority.exe," which, when run, install legitimate remote access software called SimpleHelp.
While SimpleHelp is a legitimate tool for remote computer management and support, the attackers exploit its capabilities to gain unauthorized access to employees' computers. This could allow them to view sensitive information, run commands, transfer files, and even maintain persistent access without user presence. However, Cato Networks emphasizes that these are potential capabilities, not confirmed actions taken after a successful breach.
The attack specifically targets employees in organizations across various sectors, particularly those involved in finance, accounting, and administration. The choice to impersonate the Tax Authority leverages the daily work of these employees with tax-related documents and communications. Researchers suspect the attack may be linked to the Iranian hacking group MuddyWater, known for similar phishing campaigns in Hebrew and impersonating official entities.
Cato Networks has alerted SimpleHelp to the misuse of its software, and the latter confirmed that the examined files contained components of an older version of their remote access tool, deeming it a malicious use of legitimate software. The attack method relies heavily on social engineering and user deception rather than exploiting technical vulnerabilities. Cato Networks' defense systems are blocking identified malicious websites, and monitoring continues for suspicious activity related to remote access tools.
לא אותו אירוע: ידיעות אחרות שחולקות עם הידיעה הזו אנשים, מקומות או נושא. רקע, תגובות והמשכים.
