Iranian state-sponsored threat operation MuddyWater has been using SimpleHelp remote support software to ensure persistence in devices that have been compromised in attacks since June 2022, according to The Hacker News.
Article Link: New MuddyWater attacks involve SimpleHelp remote admin tool | SC Media