[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxvT59Mn7JfPh0w07Xr9Qz1gWDtf1CVPFl3wPh4BXNMs":3},{"article":4,"iocs":43,"watch_terms":53,"solutions":54,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"ca4427ca-0e96-4d9b-9039-f4a0c9cf99c0","Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans","hackers-abuse-cruciferra-malware-as-a-service-to-conceal-infostealers-and-remote-7f29ea","Cybercriminals are renting a malware-as-a-service (MaaS) tool called Cruciferra to hide infostealers and remote access trojans (RATs) from security software. The service wraps harmful files in layers of encryption, so antivirus and endpoint detection tools struggle to spot them. It is now active in many campaigns around the world. Cruciferra is a “crypter,” a tool […] The post Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans appeared first on Cyber Security News.","Cybercriminals are utilizing a malware-as-a-service (MaaS) tool named Cruciferra to conceal infostealers and remote access trojans (RATs) from security software. This 'crypter' service, which has been active since fall 2025 and is a rebrand of the KGB cryptor, encrypts malicious files with numerous routines, making them difficult to detect. ESET Research has blocked over 700,000 compromise attempts linked to Cruciferra since January 2026, with Türkiye, Greece, and Spain being the most affected countries. The tool employs advanced techniques like DLL side-loading, sandbox evasion, BYOVD to disable EDR, and Process Ghosting to hide payloads.","Cruciferra MaaS tool used by hackers to hide infostealers and RATs via encryption.","https:\u002F\u002Fcybersecuritynews.com\u002Fcruciferra-malware-as-a-service\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Abuse-Cruciferra-Malware-as-a-Service-to-Conceal-Infostealers-and-Remote-Access-Trojans.webp","2026-11-12T12:48:24+00:00","2026-11-12T13:00:30.076426+00:00",8,[17],{"name":18,"type":19},"TA4922","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,47,49,51],{"type":24,"value":45,"context":46},"Agent Tesla","Payload delivered by Cruciferra.",{"type":24,"value":48,"context":46},"AsyncRAT",{"type":24,"value":50,"context":46},"XWorm",{"type":24,"value":52,"context":46},"zgRAT",[],{"controls":55,"vendors":137},[56,82,108],{"slug":57,"name":58,"problem":59,"products":60},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[61,69,74],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":70,"product_name":71,"url":72,"description":73},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,100],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":96,"product_name":97,"url":98,"description":99},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":109,"name":110,"problem":111,"products":112},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[138,141],{"slug":101,"name":102,"logo_path":103,"roles":139},[140],"reported_by",{"slug":142,"name":143,"logo_path":144,"roles":145},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[140],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"cruciferra-maas-crypter-hides-infostealers-and-rats-from-security-tools-at-scale","Cruciferra MaaS Crypter Hides Infostealers and RATs from Security Tools at Scale","The Cruciferra malware-as-a-service platform demonstrates how commoditized crypter tools lower the barrier for cybercriminals to deploy sophisticated malware that evades traditional security defenses. By combining DLL side-loading, sandbox evasion, Bring Your Own Vulnerable Driver (BYOVD) to disable EDR solutions, and Process Ghosting, attackers can render endpoint detection largely ineffective. With over 700,000 blocked compromise attempts in just a few months, the scale of exploitation highlights how quickly a MaaS offering can be weaponized at a global level. Organizations relying solely on signature-based or single-layer defenses are especially at risk, as these techniques are specifically engineered to bypass them.",[151,152,153,154,155],"MITRE ATT&CK T1574.002: Hijack Execution Flow: DLL Side-Loading","MITRE ATT&CK T1562.001: Impair Defenses: Disable or Modify Tools","CIS Control 10: Malware Defenses (v8)","NIST SP 800-53 SI-3: Malicious Code Protection","NIS2 Article 21(2)(f)",{"NIS2 Article 21(2)(f)":157,"CIS Control 10: Malware Defenses (v8)":158,"NIST SP 800-53 SI-3: Malicious Code Protection":159,"MITRE ATT&CK T1574.002: Hijack Execution Flow: DLL Side-Loading":160,"MITRE ATT&CK T1562.001: Impair Defenses: Disable or Modify Tools":161},"This point requires organizations to assess the effectiveness of their cybersecurity measures, which would include validating that EDR and antivirus tools can detect evasion techniques like Process Ghosting and sandbox evasion used by Cruciferra.","CIS Control 10 requires organizations to deploy and maintain anti-malware tools with behavioral detection capabilities, which would help detect the obfuscated payloads Cruciferra is designed to conceal.","SI-3 mandates the use of malicious code protection mechanisms at multiple entry points, including behavior-based detection, which is critical for catching crypter-obfuscated malware like those delivered via Cruciferra.","Cruciferra explicitly uses DLL side-loading to load malicious payloads into trusted processes, which this technique documents and for which ATT&CK provides detection and mitigation guidance.","The BYOVD technique used by Cruciferra is designed to disable EDR sensors, directly matching this technique's description of adversaries impairing security tooling to avoid detection."]