Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Malware
Proofpoint researchers have uncovered a sophisticated crypter-as-a-service called Cruciferra that is enabling multiple unrelated cybercrime clusters to deliver remote access trojans (RATs) and information stealers while evading modern endpoint defenses. Written in Mono, the crypter bundles an unusually deep set of anti-analysis features, including indirect system calls, API and Import Address Table (IAT) unhooking, privilege escalation, persistence mechanisms, and bring-your-own-vulnerable-driver (BYOVD) EDR tampering. Most notably, it implements a customized version of Process Ghosting to execute payloads while minimizing forensic artifacts on disk. Employees who click phishing links delivering such payloads should verify their exposure using an email breach checker to see whether stolen credentials are already circulating on the dark web.
Cruciferra's payload protection goes beyond typical obfuscation. The crypter uses dynamically generated encryption routines assembled from established cryptographic algorithms, hashing functions, and PRNGs, producing substantial variance between samples and complicating both static analysis and signature-based detection. Researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci noted that the encryption algorithm and string obfuscation scheme differ across sample sets, strongly suggesting polymorphic generation. Priced between $450 and $2,000 per month and advertised on cybercrime forums as "the most lethal crypter," the service first appeared for sale in fall 2025 and is being used to wrap commodity families including Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT.
The primary infection vector is phishing, with campaigns sending anywhere from hundreds to thousands of messages per wave and targeting financial services, healthcare, government, education, and manufacturing organizations. Cruciferra payloads can either be dropped encrypted to disk or fetched from attacker-controlled staging servers. One cluster attributed to the China-linked actor TA4922, which overlaps with the Silver Fox threat group, has been observed using income tax-themed lures aimed at Indian taxpayers, tax professionals, and corporate finance teams, directing victims to ZIP files hosted on attacker-controlled landing pages. Because these campaigns frequently end in credential theft, defenders should pair phishing awareness with strong credential hygiene, including running any exposed logins through a password checker to confirm they have not appeared in known breaches.
The broader implication is that commoditized crypters are now closing the technical gap between opportunistic cybercriminals and well-resourced APT-grade operators. With Process Ghosting, BYOVD, and polymorphic encryption available off-the-shelf for a few hundred dollars a month, defenders can no longer rely on a single layer of detection. A layered response, including threat intel integration, EDR tamper-protection, application allowlisting, and a routine privacy checkup on endpoint and network exposures, is necessary to counter services like Cruciferra before payloads such as AsyncRAT or XWorm establish a foothold.