Loading story…
Researchers at Acronis reported a cyberespionage campaign—tracked as CrescentHarvest—targeting Farsi-speaking individuals sympathetic to Iran’s anti-government protests, including potential dissidents and supporters abroad. The operation uses social engineering lures packaged as malicious archive files containing authentic-looking protest media and a Farsi-language report that portrays the protests positively and repeats protest slogans, likely exploiting heightened demand for information amid Iranian internet blackouts.
The archive includes files disguised as a video and an image that deploy a previously undocumented malware family dubbed CRESCENTHARVEST, assessed to function as both a remote access trojan and information stealer. Reported capabilities include command execution, keystroke logging, and theft of sensitive data such as saved credentials, browser history/cookies, and Telegram account information, along with checks for installed antivirus to modulate behavior. While no specific APT group was named, Acronis assessed the code, infrastructure, and victimology as consistent with an Iran-aligned actor; reporting also noted operational quirks (e.g., unused C2 endpoints and buggy User-Agent handling) that may indicate lower maturity or a rapidly assembled campaign tied to the protest-driven geopolitical moment.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
In its disclosure, Acronis said code, infrastructure, and scripting similarities overlapped with activity previously described by Check Point and associated with Educated Manticore, a cluster overlapping APT42/Charming Kitten/Mint Sandstorm. Acronis emphasized that this was only a low-confidence, non-definitive attribution.
On February 17, 2026, Acronis Threat Research Unit published findings on the previously undocumented CRESCENTHARVEST malware campaign targeting Farsi-speaking protesters, dissidents, and supporters of Iran's anti-government movement. The company assessed the activity as likely aligned with Iranian state interests, though it stopped short of firm attribution.
Victims who opened the disguised shortcut files triggered a PowerShell-based infection chain that established persistence and used Google-signed software_reporter_tool.exe to sideload malicious DLLs. The malware functioned as both a RAT and information stealer, targeting browser credentials, cookies, Telegram data, and keystrokes.
On or shortly after January 9, 2026, attackers began distributing Farsi-language protest-themed archives containing decoy media and malicious LNK files. At least one bait image was dated January 9, indicating the operation was active by then.
A violent crackdown began on January 8, 2026, and internet blackouts hindered reporting inside Iran. The disruption likely increased demand for protest-related updates and created favorable conditions for social-engineering lures.
Protests spread across Iran in late December 2025, creating the political context later used as bait in a cyberespionage campaign. Subsequent reporting tied the malware lures directly to these demonstrations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcetherecord.media
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
Iranian state-sponsored threat actors have intensified their cyber operations, targeting government officials, defense sector personnel, and dissidents through sophisticated espionage and disruptive campaigns. The APT42 group, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), has launched the 'SpearSpecter' campaign, employing highly personalized social engineering tactics to compromise senior defense and government officials, as well as their family members. These operations involve building trust over extended periods and leveraging fake conference invitations or meetings to deliver malicious payloads. Other Iranian-linked groups, such as Ferocious Kitten, have focused on targeting dissidents and activists with spear-phishing attacks that deploy custom malware like MarkiRAT, which features advanced data exfiltration and persistence techniques. In parallel, the DEV-1084 group, operating under the 'DarkBit' persona and closely associated with the Iranian state-linked MERCURY group, has conducted ransomware campaigns that prioritize destruction over financial gain. These attacks combine on-premises encryption with the mass deletion of cloud resources, effectively wiping out victim environments and aligning with broader strategic objectives of disruption and psychological impact. Technical analysis has revealed shared infrastructure and tools between DEV-1084 and MERCURY, further solidifying the connection to Iran’s Ministry of Intelligence and Security (MOIS). These coordinated campaigns underscore the evolving threat landscape posed by Iranian APTs, which blend espionage, destructive attacks, and advanced social engineering to achieve their objectives.
Jul 12, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026