After Iranian protests broke out and authorities clamped down on internet access in early January, security researchers from cybersecurity firm Acronis discovered a malware campaign that quickly exploited the situation.
“We found a campaign, a malware campaign, that was launched sometime in January, targeting people who are interested in information about the Iranian protests,” says Eliad Kimhy, senior security researcher at Acronis. The operation, which they have named Crescent Harvest, seems tailored for those seeking insight into events inside Iran at a time when “there’s a complete internet blackout, so nobody really knows what’s going on.”
The campaign uses protest images and a Farsi-language document as bait. The document is written in a casual, upbeat tone praising the demonstrations. Inside these files, though, is custom malware that steals information and leaves a back door open for future access.
“It’s an information stealer… meant to basically just dump all the information that it can, send it immediately to the attacker, and it leaves basically a back door open,” Kimhy says. “So it’s also a remote access Trojan. The goal of something like this is pretty much information theft and long‑term… espionage.”
The malware is embedded in an LNK file (a Windows shortcut file). These LNK files are crafted to look like videos or images, with matching icons and file extensions. When a victim clicks the short cut, a hidden script executes several steps: it extracts a ZIP archive containing the malicious payload, establishes persistence through a scheduled task triggered by internet connectivity and sideloads custom DLLs using a signed Google binary. After these processes are complete, the decoy image or video appears, masking the infection from the user.
Technically, this operation fits a pattern seen in state-backed espionage. Instead of going for quick wins like most cybercrime, the attackers aim to stay under the radar and avoid detection for as long as possible. “These types of attacks are much, much less common,” Kimhy says. “The internet is infested with attacks that are much less targeted and much more like a smash and grab.”
The team is careful to stress that they do not have a single, conclusive proof point that would allow them to definitively attribute the operation to the Iranian state or linked actors. However, the use of Farsi-language content and recent protest images, verified as authentic through reverse image search, suggests the lures are crafted to appeal specifically to Farsi-speaking Iranians, protest supporters and civil society groups seeking uncensored information during the internet blackout.
“They’re using emojis there… ‘rebellious cities’ and the starry-eyed emojis. It’s all kind of giving it this positive tone,” Kimhy observes.
He questions whether a genuine, on‑the‑ground chronicler of the protests would write this way: “I don’t know if someone that’s truly covering this would be using emojis; probably it would be a lot more serious.”
The team stumbled upon this malware by accident. “We were actually looking for an attack by a North Korean attacker called Kimsuky, and they tend to use these types of LNK files as well,” Kimhy says.
“Then we saw this Farsi-language document. We’re like, this is interesting. This is different. So we kind of jumped on that, and that’s how we found the initial files.”
From there, the team traced how the malware spreads, mapped its command-and-control set-up, and compared its toolkit to earlier attacks linked to Iran.
Unlike broad phishing storms that hit tens of thousands of inboxes at once, this campaign appears to follow a surgical, spear‑phishing approach. Comparable cases have often involved sustained engagement with high‑value targets. “They select specific individuals that they want to target: activists, journalists, people in government. And sometimes they even build their relationship beforehand. So they build trust, send them some normal files and benign things… and then the [attack] comes up.”
The team does not know how many people were targeted, but the use of new, custom malware suggests this was a serious effort, not just a test run. “It’s very unlikely that they would put all this effort into it and then not send it to anyone,” Kimhy says.
While he says that they do not know the scale of the operation or the location of its targets, Kimhy suggests that it is unlikely that the attacker would target people inside Iran during an internet lockdown. If most of the targets are outside Iran, such as journalists, analysts or activists in the diaspora, compromising their accounts could expose the local sources who provide them with information.
The analysis shows a mix of careful planning and obvious mistakes in the malware’s code. The malware has a flexible command-and-control system, can run different commands and is designed to show the expected image after infection. But some features look unfinished or configured incorrectly.
According to Subhajeet Singha, senior security researcher at Acronis, two elements stand out. The first is a user agent string, the identifier normally sent by a browser, that was clearly designed to make the malware’s outbound traffic blend in with normal web browsing. But in practice, it seems to send the C2 domain name instead, an anomaly that would make the traffic more conspicuous to analysts.
“That looks like a mistake,” Kimhy says. “Maybe they copy-pasted it and they weren’t paying attention," he adds.
The second issue lies in the command system itself. The malware defines multiple endpoints, paths like /info, intended to receive different types of data. Yet when the team ran the sample, most of those paths were never actually used.
“It kind of looks like they prepared this entire infrastructure, and then they were like, ‘Okay, we don’t have time, we’re not going to finish this,’” Kimhy says.
Some commands “just don’t seem to work”, accepting input but failing to perform any meaningful action. While he admits that it is possible he might not have found the correct way to get the commands to run, both Kimhy and Singha say this points to attackers who are skilled but working quickly to meet a deadline.
“We think they were [working in] haste,” Singha says. “We can say that they are not inexperienced, honestly, because whatever they used, it was quite [carefully] crafted… but again, they do also have deadlines, just like us.”
For those at risk of similar attacks, researchers recommend using hardware security keys, remaining highly cautious of unsolicited files – even those appearing to align with one’s interests – and recognising that timely, emotionally resonant content may be weaponised for espionage purposes.
