Eliad Kimhy
Eliad Kimhy is a Senior Security Researcher at Acronis, where he conducts research into emerging threats and cybercrime, and shares insights through conference talks and published reports. Eliad has worked with security teams for close to a decade, helping build and lead the development of threat intelligence production, and the publication of research-based content for technical and general audiences. He has spoken at conferences such as VirusBulletin, CARO, Insomnihack, Thotcon, BsidesSF, BsidesLV, and IT-SA. He is the co-creator and producer of the Webby Honoree podcast Malicious Life, which explores the untold stories and cultural history of hacking.
Session
When protesters take to the streets, someone is always watching. CRESCENTHARVEST is a cyberespionage campaign that weaponizes Iran's ongoing civil unrest, targeting Farsi-speaking supporters of the protest movement with carefully crafted lures. Victims receive what appears to be a frontline dispatch from inside Iran: protest footage, images from the streets, and a Farsi report from "the rebellious cities." Hidden inside are two files that, once clicked, compromise the victim's machine through an attack chain so seamlessly crafted that they never suspect a thing.
What unfolds beneath the surface is a sophisticated operation where trust is the exploit and sympathy is the attack vector. This paper peels back the layers of a campaign designed to blend in, stay hidden, and steal everything, tracing the full attack chain, the implant's capabilities, and the infrastructure fingerprints that tie it to a state-aligned actor with a long history of hunting its own people.