A crypter-as-a-service called Cruciferra is being used by multiple, unrelated cybercrime groups to disguise remote access trojans and infostealers well enough to slip past endpoint detection tools, Proofpoint researchers said in a report published Monday.
Proofpoint says it has tracked Cruciferra since the crypter first went up for sale on the cybercrime forum Exploit[.]in in fall 2025. Sellers advertise it as “the underground’s most lethal crypter,” charging $450 to $2,000 a month depending on feature tier.
Crypters wrap malicious code in layers of obfuscation to help it evade antivirus and endpoint detection and response (EDR) tools. Much of Cruciferra’s toolkit is standard tradecraft: indirect system calls and Import Address Table unhooking are common evasion tricks, and abusing a vulnerable driver to kill EDR processes. This is a technique known as Bring Your Own Vulnerable Driver (BYOVD).
Every documented campaign follows the same chain: a phishing email or PDF links to a landing page hosting a ZIP with an executable-DLL pair; running the executable side-loads the DLL, which is Cruciferra itself. From there, Cruciferra either drops its final payload to disk or pulls it from a staging server.
What makes Cruciferra interesting to researchers?
“Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts,” wrote authors of the report Chris Wakelin, Georgi Mladenov and Kyle Cucci.
The first stage of evasion techniques uses Process Ghosting (writing malware into a file marked for deletion before the operating system removes it from disk) coupled with a step that patches two Windows functions (ZwQueryVirtualMemory and NtManageHotPatch). Cruciferra hooks both functions in advance so they lie on command.
When EDR calls ZwQueryVirtualMemory to check the ghosted process’s memory, the hook feeds back a clean-looking answer instead of the truth. And it disables NtManageHotPatch (the function that would otherwise flag that the process’s memory doesn’t match any real file on disk) so that check just fails silently. Either way, EDR asks a question and gets a fake “all clear.”
Lastly, Cruciferra’s ability to scramble payloads using more than 90 different custom-built algorithms, each assembled from pieces of established ciphers such as Keccak, Threefish and SPECK.
“This approach creates significant variation between samples, complicating static analysis and signature-based defenses,” authors wrote.
Campaign proliferation
Researchers said it is tracking dozens of Cruciferra campaigns used to deliver commodity malware AsyncRAT, XWorm, Formbook, Remcos and zgRAT. The targets are most often financial services, healthcare and government sectors.
Between late April and early June, Proofpoint reported the Chinese-speaking group TA4922 used tax-themed phishing lures impersonating India’s Income Tax Department to deliver AsyncRAT via Cruciferra. Researchers at Deception.Pro also published details in May on this campaign.
Separate campaigns impersonated the U.S. Social Security Administration, and a late-June wave posed as hotel guest complaints about bed bugs to target hospitality and travel companies with zgRAT.
Proofpoint said it has identified both finished builds and apparent test versions of Cruciferra — evidence the service remains under active development — and will continue monitoring its evolution
“If the compile and debug timestamps are correct… we can see new builds of the crypter uploaded very regularly, showing ongoing crypter service operations,” Proofpoint authors’ warn.
Proofpoint published IOCs spanning late April through late June, including payload URLs, C2 domains and file hashes tied to the TA4922, SSA and zgRAT campaigns — a full list is available in the original report.
