MalwareNov 12, 2026

Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans

Cruciferra MaaS tool used by hackers to hide infostealers and RATs via encryption.

Cybercriminals are utilizing a malware-as-a-service (MaaS) tool named Cruciferra to conceal infostealers and remote access trojans (RATs) from security software. This 'crypter' service, which has been active since fall 2025 and is a rebrand of the KGB cryptor, encrypts malicious files with numerous routines, making them difficult to detect. ESET Research has blocked over 700,000 compromise attempts linked to Cruciferra since January 2026, with Türkiye, Greece, and Spain being the most affected countries. The tool employs advanced techniques like DLL side-loading, sandbox evasion, BYOVD to disable EDR, and Process Ghosting to hide payloads.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

The lesson from this incident

Full lesson

The Cruciferra malware-as-a-service platform demonstrates how commoditized crypter tools lower the barrier for cybercriminals to deploy sophisticated malware that evades traditional security defenses. By combining DLL side-loading, sandbox evasion, Bring Your Own Vulnerable Driver (BYOVD) to disable EDR solutions, and Process Ghosting, attackers can render endpoint detection largely ineffective. With over 700,000 blocked compromise attempts in just a few months, the scale of exploitation highlights how quickly a MaaS offering can be weaponized at a global level. Organizations relying solely on signature-based or single-layer defenses are especially at risk, as these techniques are specifically engineered to bypass them.

What helps against this

How we list vendors

ESET research Proofpoint research

Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
For exampleThreatLocker Allowlisting ThreatLocker Ringfencing Microsoft App Control for Business all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleWithSecure Elements XDR Microsoft Defender for Endpoint ESET PROTECT all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleMimecast Email Security Abnormal AI Abnormal Inbound Email Security Cloudflare Email Security all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — Agent Tesla
malware — AsyncRAT
malware — XWorm
malware — zgRAT

Entities

TA4922 (threat_actor)