CRESCENTHARVEST Uses Farsi Protest Lures in Suspected Iran-Focused Espionage Campaign

Feb 18, 2026 · Original article ↗

Summary

Acronis TRU details CRESCENTHARVEST, a suspected cyberespionage campaign using Farsi protest-themed lures and DLL sideloading to deploy a RAT and stealer. Intended victims and Iranian-aligned attribution remain uncertain.

Key points

Acronis TRU found CRESCENTHARVEST using Farsi protest-themed archives containing malicious .LNK shortcuts disguised as media; the campaign’s specific victim set is unknown.
The shortcuts extract a payload, launch scripts through PowerShell, and establish persistence with a scheduled task triggered by a Windows NetworkProfile event.
A signed Google binary, software_reporter_tool.exe, sideloads two malicious DLLs; one decrypts Chrome app-bound keys, while the other provides RAT and information-stealing capabilities.
The malware can harvest browser credentials, cookies and history, steal Telegram session data, log keystrokes, enumerate security products, and execute operator commands.
The implant sends JSON commands and exfiltrates files over HTTPS. Acronis observed servicelog-information[.]com as C2 infrastructure and linked it to 185.242.105.230.
Acronis found code and tradecraft similarities to Iranian-aligned activity but said the evidence does not support high-confidence attribution. The campaign’s likely interest in Farsi-speaking protest supporters is an assessment, not a confirmed victim profile.
Acronis reports that its EDR/XDR detects and blocks the threat.

Article Details

Attack Vectors: Farsi-language protest reports and media in RAR archives were used as lures; two malicious LNK shortcuts disguised as image and video files extracted and launched the payload.
The article says the initial dissemination mechanism was not observed; spear-phishing or prolonged social engineering are presented as possible scenarios.
A signed Google software_reporter_tool.exe loaded malicious DLLs through DLL search order hijacking.
A scheduled task triggered by a Windows NetworkProfile event (EventID 10000) ran the payload when network connectivity was established.
Defensive Notes: Treat unsolicited files with heightened skepticism, including files that appear relevant to current events or personal interests.
The article recommends hardware security keys for at-risk individuals and organizations.
Acronis reports that the threat was detected and blocked by Acronis EDR / XDR.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`servicelog-information[.]com`	C2 domain repeatedly associated with samples analyzed in the campaign.
IPV4	`185[.]242[.]105[.]230`	IP address linked to the campaign's C2 domain through TLS certificate observations and identified as C2 infrastructure.
SHA256	`03315debd0c7a253b59a6b447d0673aa3de84103ca3cd4d5b6148c018d90b39b`	SHA-256 of the malicious LNK shortcut disguised as an image file.
SHA256	`0fbc1f9cbacf076d2ced458e2d1afff0c615640a4647996bca2b651b80f90a6e`	SHA-256 of the malicious version.dll RAT and information-stealing module.
SHA256	`62c4814c88521619ec6bc42e93b88c23f6727e1413f312e53063cdf089c6bc58`	SHA-256 of files.rar, an archive containing campaign lure files and malicious content.
SHA256	`bd8a48d4dc71552c790a44065cce77c7592f1d00e6cbe904af01f1d164d4dd78`	SHA-256 of the malicious LNK shortcut disguised as a video file.
SHA256	`dde9fec23a8db87842babb40c306ee6685a13de7a6a2d9f6dc65ed5ea5df87a3`	SHA-256 of a ZIP archive identified in the campaign's file indicators.
SHA256	`e3cf12272d9103e4693333543b0f25840b18ac6bbea11d17202d752e6a49d707`	SHA-256 of a ZIP archive identified in the campaign's file indicators.
SHA256	`fc1319166cfb607402e9dcaf68ef13ce10f326dbb6ac406ef576e1c02e7404a9`	SHA-256 of urtcbased140d_d.dll, the malicious module that decrypts Chrome app-bound keys.