The Iranian threat actor known as Muddy Water, assessed to be a subordinate element within Iran’s Intelligence Ministry (MOIS), has a history of deploying legitimate remote administration tools to targeted systems, specifically targeting systems of other Middle Eastern countries and the US. Having previously leveraged ScreenConnect, RemoteUtilities, and Syncro, this time the nation-state group figured out a way to legitimately download SimpleHelp from the official website and effectively use it in their attacks. SimpleHelp is a remote device control and management software tool, and MuddyWater is using it to establish persistence on targeted devices. MuddyWater was first seen leveraging SimpleHelp as far back as June 2022. However, it’s still unclear how the software is distributed to host devices and what further actions are taken once downloaded. Researchers believe that spear-phishing emails from already compromised emails are sent with malicious links that download SimpleHelp, and then MuddyWater can use Fast Reverse Proxy (FRP) or Ligolo to establish persistence and extract information for final collection or additional lateral movement. A report released in January earlier this year encapsulated MuddyWater’s attacks in Saudi Arabia and Egypt where SimpleHelp was used to deploy a Ligolo reverse tunneling tool and harvest credentials using MKL64. CTIX continues to monitor threat organizations around the globe and will provide additional details accordingly.