CRESCENTHARVEST is a targeted cyberespionage campaign discovered by Acronis TRU in early 2026, designed to surveil and compromise Farsi-speaking Iranians sympathetic to the ongoing anti-IRGC protests. The campaign leverages geopolitical developments to deliver malware through social engineering, bundling malicious .LNK files alongside authentic protest images, videos, and a Farsi-language report titled 'the rebellious cities of Iran.'

The infection chain begins with spear-phishing or protracted social engineering, delivering a RAR archive containing decoy media and two malicious .LNK shortcuts disguised as video and image files. When clicked, the .LNK files invoke nested conhost.exe processes with --headless switches to obscure execution, spawning cmd.exe then PowerShell to extract a ZIP payload embedded within the .LNK to the user's %TEMP% folder.

Persistence is established through a novel scheduled task mechanism: instead of traditional startup triggers, the task fires on Windows NetworkProfile EventID 10000, executing the payload whenever the system establishes network connectivity — including after reboot or offline-to-online transitions.

The payload uses DLL sideloading via software_reporter_tool.exe, a legitimate Google-signed binary (Chrome's deprecated Software Reporter Tool, removed in 2023). The executable loads two malicious DLLs using LoadLibraryExA without path restrictions, enabling search order hijacking.

Module 1 (urtcbased140d_d.dll) is a C++ implant that bypasses Chrome's app-bound encryption by instantiating the browser's COM elevation broker (IElevator interface) to decrypt the master key from the Local State file. The decrypted key is saved to APPDATA\decrypted_appbound_key.txt and shared with Module 2 via a named pipe. This module shows heavy code overlap with the open-source ChromElevator project. PDB path artifact: E:\new\stealer\Stealer\x64\Release.

Module 2 (version.dll) is the main RAT/infostealer with extensive capabilities: keylogging via WH_KEYBOARD_LL hooks (logging to C:\Windows\System32\spool\Drivers\color\daT.txt), browser credential harvesting (Chrome, Firefox, Edge), Telegram Desktop session theft, user enumeration, shell command execution, directory traversal, DLL loading, WMI-based security product detection, and system profiling. It uses PEB walking to resolve APIs dynamically and XOR decryption with key '!@#$6756' for string obfuscation. Anti-analysis employs Windows Job Objects to restrict process memory ('Process on a Diet' technique).

C2 communications use JSON over HTTPS via WinHTTP APIs. The implant registers with {"Identifier":"admin"} and receives commands like KeyLog, Tel_s, F_log, Cook, GetUser, shell. A notable bug causes the malware to send the C2 domain as its User-Agent instead of the intended Chrome UA string, reducing evasion effectiveness. Multiple predefined C2 endpoints (/register_agent, /info, /Out, /upload, etc.) exist but most operations route through /Out and /upload.

Infrastructure centers on servicelog-information[.]com resolving to 185.242.105.230 hosted in Riga, Latvia on ASN AS42532 (VEESP-LV-AS), with historical Cloudflare CDN proxying via AS13335. The code shows methodological similarities to campaigns attributed to Iranian threat groups documented by Check Point Research (Educated Manticore, Nimbus Manticore), including similar LNK unpacking scripts, JSON-based C2 communication, and WinHTTP exfiltration patterns.