{
  "family": "harvester",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nHarvester (often detected as Spyware.Harvester or Trojan.Harvester) is a highly specialized info-stealer malware engineered specifically to target, aggregate, and extract sensitive data from compromised Windows endpoints. Unlike generic droppers, Harvester's primary objective is immediate espionage: it actively scrapes the file system and intercepts communications to harvest user credentials, financial information, and valuable intellectual property.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHarvester is typically distributed via highly targeted spear-phishing campaigns containing weaponized attachments or delivered as a secondary payload by an initial access broker.\n\nOnce executed, the malware focuses entirely on data aggregation:\n<ul>\n<li><strong>Browser Profiling and Cookie Theft:</strong> Harvester aggressively targets nearly all modern web browsers (Chrome, Firefox, Edge). It extracts saved passwords, autofill data, credit card numbers, and critically, active session cookies (allowing attackers to bypass MFA).</li>\n<li><strong>File System Scraping:</strong> The malware often includes a module to recursively scan the local hard drive and attached network shares for files matching specific extensions (e.g., `.docx`, `.pdf`, `.kdbx` for password vaults) or containing specific keywords (e.g., \"password\", \"finance\").</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is aggregated into hidden, encrypted ZIP archives on the local disk. It is then periodically transmitted back to the C2 server over standard web ports (HTTPS) or via FTP to evade deep packet inspection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Harvester infection is a critical security breach resulting in immediate and ongoing data loss. The exfiltrated credentials can be used to compromise the user's personal accounts, pivot laterally across the corporate network, or access sensitive cloud infrastructure without triggering brute-force alerts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt any active or pending data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials typed or saved on the infected machine since the time of infection are fully compromised. Initiate an immediate, organization-wide password reset for the affected user, and invalidate all active session tokens.</li>\n<li><strong>Forensic Analysis:</strong> Conduct a forensic review of the endpoint to determine the initial vector of compromise and to ensure Harvester did not deploy secondary backdoors prior to detection.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Harvester",
    "Spyware.Harvester",
    "PWS.Win32.Harvester"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1539",
    "T1048",
    "T1552.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:00:58Z",
  "type": "Info-stealer / Spyware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}