Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
China-linked cybercrime group employs advanced encryption techniques.
1What is Cruciferra Crypter?
Cruciferra Crypter is an advanced encryption service used by a China-linked cybercrime group. This service is utilized by various unrelated cybercriminal clusters to distribute remote access trojans (RATs) and information stealer malware. Written in Mono, Cruciferra incorporates numerous techniques designed to evade detection, analysis, and incident response efforts. These techniques include indirect system calls, API and IAT unhooking, BYOVD-based EDR tampering, and a customized implementation of Process Ghosting. Cruciferra enables malicious actors to obfuscate their payloads, thereby increasing malware delivery success rates.
2Encryption and Evasion Techniques
Cruciferra places a strong emphasis on payload protection and supports various custom encryption routines. These routines are dynamically derived and assembled from established cryptographic algorithms, introducing variations between samples and complicating static analysis and signature-based detections. According to researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci, the algorithm used to encrypt payloads and strings in each sample set is different, with such a large variance that it is likely randomly generated from elements of well-known hashing, PRNG, and cipher algorithms. This indicates that Cruciferra has a polymorphic structure.
3Its Place in the Cybercrime Market
Cruciferra is advertised on the cybercrime underground as the 'most lethal crypter,' with a monthly price ranging from $450 to $2,000. First made available for sale in fall 2025, the service has been used to distribute various commodity malware families, including Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT. Campaigns leveraging Cruciferra typically use phishing as the primary initial access vector, with the flexibility to either drop an encrypted payload to disk or download it from a staging server. These activities are assessed as opportunistic, sending hundreds to thousands of messages per campaign.
4Target Sectors and Campaigns
Primary targets of Cruciferra include financial services, healthcare, government, education, and manufacturing sectors. A campaign attributed to Chinese-speaking cybercrime actor TA4922, which overlaps with another prolific threat group called Silver Fox, employs tax-themed lures to drive victims to attacker-controlled landing pages hosting ZIP files to deliver malware. Four such campaigns were identified between April and early June 2026. This attack was documented in detail earlier this month by Seqrite Labs and Cyderes Howler Cell, who are tracking the activity under the moniker Operation DragonReturn.
5DLL Side-Loading and EDR Evasion
Regardless of the campaign, Cruciferra is always executed via DLL side-loading, leveraging evasion and anti-analysis techniques to fly under the radar. These techniques include hiding console windows, unhooking Windows API functions to reduce visibility, indirect system calls, disabling user notifications, and abusing the 'GoFlyDrv.sys' driver as part of a BYOVD attack to terminate security processes. Cruciferra checks if it is running with Administrator privileges and, if not, attempts to elevate its privileges by bypassing UAC using the COM Elevation Moniker. Additionally, it establishes persistence by writing to the registry Software\Microsoft\Windows\CurrentVersion\Run key with a default value of 'putty.'
6Payload Loading via Process Ghosting
The final payload is loaded into memory using a variant of Process Ghosting, an advanced malware evasion technique on Windows where malicious code is executed from a temporary file deleted from the disk before the process starts. This blinds security products as there is no 'file' to scan. Cruciferra leverages this technique to make detection difficult and ensure successful malware execution. Process Ghosting highlights Cruciferra's unique defense-evasion capabilities, setting it apart from other crypters.
7Modular Design and Customization
Cruciferra distinguishes itself through its modular design and highly customized, varied approach to payload protection. According to Proofpoint's analysis, Cruciferra's defense-evasion capabilities are so extensive and unique that they make it stand out in the cybercrime ecosystem. Unlike traditional crypters, which have long been used to increase malware delivery and execution success rates, Cruciferra offers a more advanced and multifaceted approach. This makes it an attractive tool for cybercriminals seeking to evade detection and improve their attack success rates.
8Conclusion and Implications
Cruciferra Crypter emerges as a new threat in the cybercrime world. Its advanced encryption and evasion techniques make it difficult for security products to detect and increase malware delivery success rates. Targeting critical sectors such as financial services, healthcare, government, and education, this tool poses a significant concern for cybersecurity professionals. As Proofpoint highlights, Cruciferra's unique capabilities set it apart from other crypters, making it an indispensable tool for cybercriminals. Therefore, developing effective defense strategies against Cruciferra is of paramount importance.
Original article: The Hacker News — Cruciferra Crypter ile Windows Zararlı Yazılımları Gizleniyor