A new malware campaign named CRESCENTHARVEST has emerged, leveraging the ongoing geopolitical unrest in Iran to target supporters of the Iranian protests.
For the past two weeks, the Acronis TRU team has been closely monitoring this campaign, which primarily targets Iranian citizens and individuals sympathetic to the protests abroad.
The attackers are exploiting current political sentiment by embedding social engineering tactics and deploying malware to install a remote access tool (RAT) to steal information.
Campaign Tactics and Social Engineering
The CRESCENTHARVEST malware campaign uses Farsi-language content to lure victims, capitalizing on the political climate surrounding the Iranian protests.
This social engineering tactic involves distributing a .RAR archive containing videos and images from the protests, along with a malicious document named گزارش.docx (report.docx) that purports to offer updates on the protests.
However, embedded within the archive are two malicious LNK (Windows shortcut) files disguised as harmless media content. Once opened, these files deploy a PowerShell script that runs the malware.
The script extracts and loads malicious payloads, creating persistence on the infected system. This persistence is uniquely designed to trigger when the victim’s system connects to a network, ensuring the malware operates even after a reboot.
The malware uses DLL sideloading, leveraging trusted executables like software_reporter_tool.exe (a Google cleanup utility) to evade detection and load malicious dynamic link libraries (DLLs).
RAT and Information Theft
Once executed, the malware functions as a RAT and information stealer. The first stage of the attack involves using the urtcbased140d_d.dll implant, which decrypts browser encryption keys, specifically targeting Google Chrome.
This implant harvests sensitive data, including browser credentials, cookies, and session data, from applications such as Telegram. It then exfiltrates this data to the attacker’s command-and-control (C2) server.
The second implant, delivered by version.dll, acts as a backdoor that can steal even more data, such as user credentials, browsing history, and cookies. It also includes a keylogging feature that captures every keystroke from the victim’s system and stores it in a hidden file.
Once the file reaches a specific size, it is uploaded to the C2 server. This functionality is especially dangerous, as it enables attackers to track sensitive user activity, further compromising victims’ privacy and security.
CRESCENTHARVEST is a stark reminder of how cybercriminals can exploit geopolitical tensions to advance espionage activities.
This campaign highlights the evolving nature of cyberattacks, with threat actors increasingly using current events and political movements to craft sophisticated attacks.
The malware’s use of social engineering, DLL sideloading, and advanced exfiltration techniques demonstrates its high level of sophistication.
As this campaign is likely targeting Farsi-speaking individuals in support of the Iranian protests, it underscores the importance of remaining vigilant.
Organizations and individuals aligned with politically sensitive causes should treat unsolicited files with suspicion, use hardware security keys, and implement strong security measures to protect themselves from this growing threat.
The CRESCENTHARVEST malware has been detected and blocked by Acronis EDR/XDR systems. However, with attackers constantly refining their techniques, this threat remains a concern for individuals and organizations in vulnerable regions.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
