New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide
New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide
July 28, 2026 
Proofpoint uncovered Cruciferra, a crypter-as-a-service that helps hackers evade antivirus and deliver malware in multiple campaigns.
Proofpoint’s research team traced a wave of income-tax-themed lures targeting Indian taxpayers, tax professionals, and corporate finance teams back to a crypter service called Cruciferra, and the tool turns out to be shared infrastructure used across multiple unrelated criminal groups.
A crypter’s job is simple to describe and hard to build well: scramble a malicious payload so antivirus tools can’t detect it, then unwrap it at just the right moment on the victim’s machine. Cruciferra does that job with a level of polish researchers don’t see often. It’s written in Mono and packs in indirect system calls, API unhooking, and a custom flavor of Process Ghosting designed to leave almost nothing behind for a forensic investigator to find.
“Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts. These include using indirect system calls, API and Import Address Table (IAT) unhooking, Bring-Your-Own-Vulnerable-Driver (BYOVD)-based EDR tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting used to execute payloads while minimizing forensic artifacts.” reads the report. “The crypter also includes a notable emphasis on payload protection. Cruciferra supports a large collection of custom encryption routines, many of which appear to be dynamically assembled from components of established cryptographic algorithms. This approach creates significant variation between samples, complicating static analysis and signature-based defenses. “
The pricing alone tells you this is a serious commercial operation, not a hobbyist’s side project. Sellers have advertised it on underground forums since fall 2025 for between $450 and $2,000 a month, marketed bluntly as one of the most effective crypters available. That price bought access to protection for a long list of commodity malware, including Agent Tesla, AsyncRAT, Remcos RAT, Snake Keylogger, XWorm, and several others.
What makes Cruciferra genuinely hard to fingerprint is that it doesn’t use one fixed encryption method. Each batch of samples gets its own encryption routine, built by mixing and matching pieces from well-known hashing, random number generation, and cipher algorithms, which means two Cruciferra samples can look completely unrelated at the code level. Researchers suspect this variation gets generated automatically rather than handpicked by a human, since the sheer number of combinations would be tedious to produce by hand.
One campaign traced to Cruciferra belongs to TA4922, a Chinese-speaking group with some overlap with another well-known operation called Silver Fox. TA4922 sent victims to fake landing pages hosting ZIP files disguised as tax documents, with four separate waves identified between April and early June 2026.
Cruciferra shows up in other unrelated campaigns too, which is really the point. One wave impersonated the US Social Security Administration to deliver XWorm and AdaptixC2 back in May, while another used complaints about bed bugs to target hotels and travel companies with zgRAT malware in late June. Different lures, different final payloads, same wrapper doing the hiding.
“Tax and government-related themes are frequent favorites of cybercriminals, and the U.S. Social Security Administration (SSA) is often abused in malware campaigns, including from actors using Cruciferra.” continues the report. “For example, in May, Proofpoint researchers observed emails impersonating the SSA regarding tax documents. (Curiously, the emails referred to items that needed to be completed by January 2026; it’s possible the actor repurposed an old lure, or mistakenly included the wrong date.)”
However it gets deployed, Cruciferra always loads through DLL side-loading and leans on the same set of evasion tricks. It hides its console window, strips visibility from Windows API calls, and abuses a vulnerable driver called GoFlyDrv.sys to kill off security processes running on the machine, a technique known in the industry as bring-your-own-vulnerable-driver. If it isn’t already running with administrator rights, it quietly bypasses Windows’ UAC prompt using a known COM elevation trick, then plants itself in the registry’s Run key under the unassuming name “putty” so it survives a reboot.
The final payload never actually touches disk as a real file. Cruciferra uses a variant of Process Ghosting, running code from a temporary file that gets deleted before the process even starts, which leaves security software with nothing to scan because there’s technically no file there.
“Process Ghosting is when malware creates a temporary file, marks it for pending deletion via NtSetInformationFile, writes the malicious payload into it, then creates an image section (NtCreateSection with SEC_IMAGE) from that file. Once the file handle is closed, the operating system deletes the file from disk while the section persists in memory.” states the report.”A legitimate process is then created in a suspended state, the ghost section is mapped into it via NtMapViewOfSection, the thread context is redirected to the payload’s entry point, and the thread is resumed. The result is a running process backed by a PE image that never existed on disk in a scannable state.”
On top of that, it patches memory-query hooks and tries to interfere with a Windows routine that manages hot patches, covering its own tracks and disabling integrity checks along the way.
None of the individual tricks here are brand new on their own. What stands out is how many of them Cruciferra stacks together in one modular package, built to protect whatever malware a customer wants to hide that week. Calling something “the most lethal crypter” in a forum ad is usually just sales talk, but this is one of the rare cases where the product notes actually undersell it.
“While crypters have long been used to evade detection and increase malware delivery and execution success rates, Cruciferra distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection.” concludes the report. “During our investigations, we observed Cruciferra delivering numerous malware families, including various remote access trojans and infostealers, highlighting its role as an enabling technology within the cybercrime ecosystem. Proofpoint will continue to monitor the development and adoption of Cruciferra and provide updates as new capabilities and campaigns are identified. “
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Cruciferra)
