From the Rebellious Cities: How Iranian APTs spy on their own people

DAY 1

14:30-
15:10

When protesters take to the streets, someone is always watching. CRESCENTHARVEST is a cyberespionage campaign that weaponizes Iran’s ongoing civil unrest, targeting Farsi-speaking supporters of the protest movement with carefully crafted lures. Victims receive what appears to be a frontline dispatch from inside Iran: protest footage, images from the streets, and a Farsi report from “the rebellious cities.” Hidden inside are two files that, once clicked, compromise the victim’s machine through an attack chain so seamlessly crafted that they never suspect a thing.

What unfolds beneath the surface is a sophisticated operation where trust is the exploit and sympathy is the attack vector. This talk peels back the layers of a campaign designed to blend in, stay hidden, and steal everything, tracing the full attack chain, the implant’s capabilities, and the infrastructure fingerprints that tie it to a state-aligned actor with a long history of hunting its own people.

Location :
- Track 1(HALL B)
Category :
- Technical
Share :

Speakers

Eliad Kimhy

エリアド・キムヒ

Eliad Kimhy is a Senior Security Researcher at Acronis, where he conducts research into emerging threats and cybercrime, and shares insights through conference talks and published reports. Eliad has worked with security teams for close to a decade, helping build and lead the development of threat intelligence production, and the publication of research-based content for technical and general audiences. He has spoken at conferences such as VirusBulletin, CARO, Insomnihack, Thotcon, BsidesSF, BsidesLV, and IT-SA. He is the co-creator and producer of the Webby Honoree podcast Malicious Life, which explores the untold stories and cultural history of hacking.

Eliad Kimhy is a Senior Security Researcher at Acronis, where he conducts research into emerging threats and cybercrime, and shares insights through conference talks and published reports. Eliad has worked with security teams for close to a decade, helping build and lead the development of threat intelligence production, and the publication of research-based content for technical and general audiences. He has spoken at conferences such as VirusBulletin, CARO, Insomnihack, Thotcon, BsidesSF, BsidesLV, and IT-SA. He is the co-creator and producer of the Webby Honoree podcast Malicious Life, which explores the untold stories and cultural history of hacking.
Subhajeet Singha

スバジート・シンハ

Subhajeet Singha is a senior threat researcher at TRU Labs at Acronis, specializing in threat intelligence, malware research, and reverse engineering. His work focuses on analyzing emerging cyber threats, uncovering sophisticated attack campaigns, and enhancing detection mechanisms to strengthen cybersecurity defenses. With a deep understanding of malware behavior and threat actor tactics, Subhajeet actively investigates advanced persistent threats (APTs), reverse-engineers complex malware strains, and contributes to research initiatives that improve industry-wide threat detection. He has previously spoken in conferences like Virus Bulletin, Positive Hack Talks, AVAR & ROOTCON, VULNCON.

Subhajeet Singha is a senior threat researcher at TRU Labs at Acronis, specializing in threat intelligence, malware research, and reverse engineering. His work focuses on analyzing emerging cyber threats, uncovering sophisticated attack campaigns, and enhancing detection mechanisms to strengthen cybersecurity defenses. With a deep understanding of malware behavior and threat actor tactics, Subhajeet actively investigates advanced persistent threats (APTs), reverse-engineers complex malware strains, and contributes to research initiatives that improve industry-wide threat detection. He has previously spoken in conferences like Virus Bulletin, Positive Hack Talks, AVAR & ROOTCON, VULNCON.

Back to Time Table