Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

Summary

A sophisticated crypter service named Cruciferra, written in Mono, is being used by various cybercriminal groups to obfuscate and deliver malware. It employs advanced evasion techniques like BYOVD-based EDR tampering and Process Ghosting, making analysis difficult. Advertised as the 'most lethal crypter,' it supports numerous malware families and has been linked to China-linked threat actors.

Full text

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware Ravie LakshmananJul 27, 2026Malware / Email Security The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote access trojans (RATs) and information stealer malware. "Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts," the enterprise security company said in an analysis published last week. "These include using indirect system calls, API and Import Address Table (IAT) unhooking, bring-your-own-vulnerable-driver (BYOVD)-based EDR tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting used to execute payloads while minimizing forensic artifacts." Crypters (also spelled cryptors) play an important role in the cybercriminal ecosystem as they allow bad actors to obfuscate their payloads, avoid detection, and improve malware delivery success rates. An emphasis on payload protection notwithstanding, Cruciferra supports various custom encryption routines that appear to be dynamically derived and assembled from established cryptographic algorithms, thereby introducing variations between samples and complicating static analysis as well as signature-based detections. "The algorithm used to encrypt payloads and strings in each set of samples is different, and there is such a large variance of these algorithms, which means it is probably randomly generated (polymorphically) from elements of well-known hashing, PRNG, and cipher algorithms," per researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci. The service has been advertised on the cybercrime underground as the "most lethal crypter" for $450 to $2,000 a month. It was first made available for sale in fall 2025. Some of the commodity malware families distributed via Cruciferra include Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT. Campaigns leveraging the crypter have leveraged phishing as the primary initial access vector, with the tool incorporating the flexibility to either drop an encrypted payload to disk or download it from a staging server. The activity is assessed to be opportunistic, reaching anywhere between hundreds and thousands of messages per campaign. The primary targets include financial services, healthcare, government, education, and manufacturing sectors. One such campaign has been attributed to Chinese-speaking cybercrime actor TA4922, which shares some level of overlap with another prolific threat group called Silver Fox. This involves employing tax-themed lures to drive victims to attacker-controlled landing pages hosting ZIP files to deliver malware. Four such campaigns have been identified between April and early June 2026. It's worth mentioning here that this attack was documented in detail earlier this month by Seqrite Labs and Cyderes Howler Cell. Seqrite Labs is tracking the activity under the moniker Operation DragonReturn. Other campaigns that have been observed using Cruciferra are below - Emails impersonating the U.S. Social Security Administration (SSA) to deliver XWorm and AdaptixC2 (May 2026) Email using themes related to bed bugs and guest complaints to target organizations in the hospitality and travel industries and deliver zgRAT (late June 2026) Regardless of the campaign, Cruciferra is always executed via DLL side-loading, while leveraging evasion and anti-analysis techniques to fly under the radar. This includes hiding console windows, unhooking Windows API functions to reduce visibility, indirect system calls, disabling user notifications, and the abuse of the "GoFlyDrv.sys" driver as part of a BYOVD attack to terminate security processes. "Cruciferra checks if it is running with Administrator privileges, and if not, attempts to elevate its privileges by bypassing UAC using the COM Elevation Moniker," Proofpoint explained. "Additionally, Cruciferra establishes persistence by writing to the registry Software\Microsoft\Windows\CurrentVersion\Run key with a default value of 'putty.' This ensures Cruciferra runs after system reboot." The final payload is loaded into memory using a variant of Process Ghosting, which, at a high level, refers to an advanced malware evasion technique on Windows where malicious code is executed from a temporary file that is deleted from the disk before the process starts. This, in turn, blinds security products as there is no "file" to scan. Cruciferra adds an extra layer of sophistication by patching ZwQueryVirtualMemory hooks and by attempting to tamper with the NtManageHotPatch routine to hide the deletion of the file and neutralize integrity checks. "While crypters have long been used to evade detection and increase malware delivery and execution success rates, Cruciferra distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection," Proofpoint concluded. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cybercrime, email security, endpoint security, Information Stealer, Malware, Phishing, Remote Access Trojan, Threat Intelligence, Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Indicators of Compromise

• malware — Agent Tesla
• malware — AsyncRAT
• malware — DarkCloud Stealer
• malware — Formbook
• malware — Phantom Stealer
• malware — Remcos RAT
• malware — Snake Keylogger
• malware — ValleyRAT
• malware — XLoader
• malware — XWorm
• malware — zgRAT
• malware — AdaptixC2

Entities