Cybersecurity researchers from Acronis Threat Research Unit (TRU) have identified a new campaign named CRESCENTHARVEST, which targets supporters of Iran’s ongoing protests. The campaign, active since at least January 9, delivers a malicious payload that functions as a remote access trojan (RAT), enabling information theft and long-term espionage.

This activity highlights the use of cyber threats to suppress dissent and gather intelligence on protest movements, posing significant risks to privacy and security for those involved. The RAT malware allows attackers to remotely control infected systems, potentially leading to data breaches and surveillance.

Key Takeaways

  • CRESCENTHARVEST campaign targets Iran protest supporters with RAT malware
  • Designed for information theft and long-term espionage
  • Observed by Acronis TRU after January 9
  • Highlights cyber threats against political dissent and protest movements

Source: The Hacker News