cyber.hendryadrian.com
Security News · securityonline.info

CRESCENTHARVEST Campaign Uses Protest-Themed Lures to Target Iranian Dissidents

· Original article ↗

Summary

Acronis TRU reports that CRESCENTHARVEST uses protest-themed .LNK lures and DLL sideloading through a signed Google executable to deploy a RAT capable of command execution, keylogging and data theft against Iranian dissidents and supporters.

Key points

  • Acronis TRU reports that CRESCENTHARVEST targets Iranian dissidents and protest supporters with politically themed lures.
  • The lures use .LNK files disguised as media or reports, bundled with legitimate media and a Farsi-language report.
  • The payload is loaded through DLL sideloading using a digitally signed Google executable.
  • The RAT can execute commands, log keystrokes and exfiltrate data; the report says it appears to reuse open-source code.
  • Acronis TRU recommends hardware security keys for at-risk individuals and caution with unsolicited protest-related files.

Article Details

Event Type
Targeted cyber-espionage campaign using protest-themed lures and DLL sideloading to deploy a remote access trojan.
Impact
The campaign targets Iranian dissidents and protest supporters. The reported malware can execute commands, log keystrokes, and exfiltrate victim data; the article does not report specific confirmed victim losses.

MITRE ATT&CK

T1056.001 · KeyloggingThe reported RAT is capable of keylogging.T1204.002 · Malicious FileVictims are lured into opening malicious .LNK files disguised as protest-related media or reports.T1574.002 · DLL Side-LoadingThe payload is loaded using DLL sideloading with a signed Google executable.

Malware

CRESCENTHARVESTAcronis TRU has identified a targeted cyber espionage campaign called CRESCENTHARVEST that exploits political unrest in Iran to lure dissidents and supporters with protest-themed files and deploy a versatile remote

Vendors

GoogleThe attack uses DLL sideloading via a signed Google executable to load the payload, and Acronis TRU advises at-risk individuals to adopt hardware security keys and treat unsolicited protest-related files with extreme

Countries

Iranidentified a targeted cyber espionage campaign called CRESCENTHARVEST that exploits political unrest in Iran to lure dissidents and supporters with protest-themed files and deploy a versatile remote access trojan

Related Articles