Malware
CRESCENTHARVEST
- First Reported
- Feb 18, 2026
- Latest Reported
- Feb 18, 2026
Reported Context (2)
- Acronis TRU uncovered a targeted espionage campaign named CRESCENTHARVEST that uses Farsi-language protest lures to trick victims into opening malicious .LNK shortcuts and install a multi-module stealer/RAT. CRESCENTHARVEST Uses Farsi Protest Lures in Suspected Iran-Focused Espionage Campaign
- Acronis TRU has identified a targeted cyber espionage campaign called CRESCENTHARVEST that exploits political unrest in Iran to lure dissidents and supporters with protest-themed files and deploy a versatile remote CRESCENTHARVEST Campaign Uses Protest-Themed Lures to Target Iranian Dissidents
MITRE ATT&CK (15)
Vendors (2)
Products (4)
Tools (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.