CRESCENTHARVEST: Iranian protestors and dissidents targeted in cyberespionage campaign

**Executive Summary:** Acronis TRU identified a targeted espionage campaign dubbed CRESCENTHARVEST that lures Farsi-speaking individuals with protest-themed archives containing malicious .LNK shortcuts; the attack uses DLL sideloading of a signed Google binary to deploy two implants — one that decrypts Chrome app-bound keys and another that functions as a RAT/infostealer (keylogger, browser credential and Telegram data theft) — communicating with a C2 at servicelog-information.com (185.242.105.230); the report provides technical analysis, IoCs and notes probable Iranian-aligned motives with recommended defensive actions.