CRESCENTHARVEST Malware Campaign Uses Iran Protest Lures to Deploy Info‑Stealing RAT

A new malware campaign, dubbed CRESCENTHARVEST, that abuses the ongoing Iran protest narrative to deliver a powerful information‑stealing remote access trojan (RAT) against Farsi‑speaking users.

The operation appears tailored to supporters of the protests and other Iran‑focused audiences, with a clear focus on long‑term surveillance rather than short‑lived disruption.

The campaign surfaced shortly after January 9 and relies on politically themed lures that bundle genuine protest footage with weaponized Windows shortcut (.LNK) files.

Victims are enticed with archives that appear to contain frontline “updates” from Iran, including images, videos, and a Farsi‑language document describing “the rebellious cities of Iran” and recent protest actions.

While the content portrays demonstrators in a sympathetic light, it carefully avoids graphic material, likely to keep the package shareable and believable.​

Inside these archives, two .LNK files masquerade as regular media assets, reusing familiar video and image icons and extensions to lower suspicion.

Acronis’ Threat Research Unit (TRU) has uncovered a malware campaign, dubbed CRESCENTHARVEST, potentially targeting supporters of Iran’s ongoing protests.

When opened, each shortcut quietly launches a chain of nested, headless conhost.exe instances, which then spawn cmd.exe and PowerShell to extract and execute the real payload from within the .LNK itself.

CRESCENTHARVEST Malware

The script writes a ZIP archive to the user’s temporary directory, unpacking a signed Google executable (software_reporter_tool.exe), malicious DLLs and the decoy media file that is shown to the victim to complete the illusion of legitimacy.​

Persistence is achieved via a scheduled task bound to Windows NetworkProfile events, ensuring the payload runs when the machine gains network connectivity rather than only at boot.

This event‑driven approach increases the chances that the malware will beacon out whenever the system comes online, even if the victim attempts to stay mostly offline.

The core implant is then deployed through DLL sideloading: the signed Software Reporter Tool binary is abused to load two crafted DLLs, urtcbased140d_d.dll and version.dll, via LoadLibraryExA without strict path controls.​

The first module focuses on defeating browser app‑bound encryption by interacting with Chrome’s COM‑based elevation mechanisms to recover and decrypt the app‑bound master key from the Local State file.

It builds a detailed browser context, initializes COM, creates an elevated broker object, and uses it to request decryption of the app_bound_encrypted_key value, then writes the decrypted key to disk and exfiltrates it through a named pipe to the second module.

Code artifacts and logic closely resemble the open‑source ChromElevator project, highlighting the operator’s reliance on publicly available tooling to accelerate development.​

The second module, implemented as a malicious version.dll, operates as a fully featured RAT and stealer that resolves most of its APIs dynamically via PEB walking and simple XOR‑based string decryption.

Broader Implications

It implements anti‑analysis tricks using Windows Job Objects, enumerates threads, and tailors execution to the host’s Windows build number, then exposes capabilities for user enumeration, directory listing, shell command execution and arbitrary DLL loading on demand.

Review of publicly reported Iranian cyberespionage operations, as well as other similar attacks, indicates that this campaign may have begun with a spear phishing attack, or with protracted social engineering campaigns.

A dedicated KeyboardEvent export sets a global low‑level keyboard hook to log keystrokes into a hidden file, which is periodically uploaded to command‑and‑control (C2) once a size threshold is met and then wiped.​

Beyond keylogging, the implant systematically harvests browser credentials, cookies and history from Chrome, Edge and Firefox, storing them in a hidden directory before compressing and sending them to the C2.

Due to the many functions of CRESCENTHARVEST, and its ability to both act as a RAT and a stealer, it requires a robust C2 mechanism that can support a myriad of commands, and a complex command syntax.

It can also locate Telegram Desktop installations, copy full session data into a staging directory, archive it and exfiltrate it, then remove traces from disk.

The earlier recovered app‑bound keys are reused by this module to decrypt protected browser data, significantly increasing the value of the stolen information.​

C2 communications use JSON messages over HTTPS via Windows WinHTTP APIs, with commands such as KeyLog, GetUser, Cwd, Tel_s, Cook and F_log controlling different data theft and reconnaissance actions.

The malware defines an extensive set of REST‑like endpoints (for example /register_agent, /Info, /Out, /Upload), but many of them remain unused, with most operations funneled through a smaller subset, suggesting rushed or incomplete implementation.

A nominally legitimate Chrome‑like user‑agent string is prepared in code, yet tests show the malware often sends the C2 URL itself as the user‑agent, a bug that paradoxically makes traffic more conspicuous.​

Samples analyzed by Acronis connect to infrastructure centered on the domain servicelog-information[.]com, resolving to hosting in Latvia’s VEESP‑LV network, with evidence of intermittent Cloudflare proxying for additional cover.

While direct attribution remains low‑confidence, the victimology, Farsi‑language lures, protest‑aligned themes and overlaps with prior Iran‑linked tradecraft point toward an Iranian‑aligned threat actor seeking to monitor protest supporters, journalists and activists inside and outside Iran.

For at‑risk users, this campaign reinforces the need to distrust unsolicited protest‑related archives, favor hardware security keys, and treat emotionally resonant content as a potential attack vector rather than proof of authenticity.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.