Loading malware…
Cruciferra is a commercial crypter-as-a-service used by multiple unrelated cybercriminal groups to obfuscate and deliver commodity malware on Windows systems. Active since at least late 2025, it has been used to protect and deploy a broad range of payloads including remote access trojans, information stealers, and keyloggers such as AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT, Snake Keylogger, zgRAT, Formbook, XLoader, DarkCloud Stealer, and Phantom Stealer. The service appears to be actively maintained, with both production and testing variants observed.
Cruciferra is written in Mono and, in observed campaigns, is consistently executed through DLL side-loading. Typical delivery chains use phishing-themed lures and archives containing a legitimate executable paired with a malicious DLL; launching the executable causes the DLL to be loaded and the crypter to begin execution. Campaigns have also used landing pages and related lure infrastructure to distribute these archives. Observed themes have included tax, government, and hospitality-related pretexts, and targeting has been largely opportunistic, with financial services, healthcare, government, education, manufacturing, travel, and hospitality organizations among affected sectors.
Its primary value to operators is defense evasion. Cruciferra employs extensive anti-analysis and anti-detection measures including decoy exports, sandbox and virtual-machine checks, indirect system calls, API and Import Address Table unhooking, and suppression of user-visible artifacts such as console windows. It has also been observed using bring-your-own-vulnerable-driver techniques to tamper with endpoint security controls and terminate security processes, as well as modifying system settings to reduce notifications. Payload protection is highly variable across samples, with more than 90 custom or hybrid encryption routines assembled from components of established cryptographic designs, complicating static analysis and signature-based detection.
For execution, Cruciferra stores or retrieves an encrypted payload, decrypts it, and launches it using a customized Process Ghosting technique designed to minimize useful on-disk artifacts and hinder forensic inspection. Additional measures have been observed to sanitize memory-query results and interfere with image-validation mechanisms used by defenders. Some variants also include privilege-escalation and persistence functionality.
Multiple Cruciferra-enabled campaigns have been linked to the Chinese-speaking threat actor TA4922, which used themed lures to deliver AsyncRAT. Other unrelated actors have used the service to deliver XWorm, zgRAT, and other commodity malware families. Cruciferra functions as an enabling layer in the cybercrime ecosystem rather than as the final payload itself, improving malware delivery success by wrapping payloads in heavily obfuscated, evasive, and frequently changing code.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
According to new research from Proofpoint published on July 20, the crypter, marketed as Cruciferra, was first offered for sale on the Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.
Proofpoint uncovered Cruciferra, a crypter-as-a-service that helps hackers evade antivirus and deliver malware in multiple campaigns.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The crypter also seeks administrator rights, changes registry settings to suppress Windows notifications, and creates persistence after reboot.
The final payload is loaded into memory using a variant of Process Ghosting.
It hides its console window, strips visibility from Windows API calls, and abuses a vulnerable driver called GoFlyDrv.sys to kill off security processes running on the machine, a technique known in the industry as bring-your-own-vulnerable-driver.
The crypter also seeks administrator rights, changes registry settings to suppress Windows notifications, and creates persistence after reboot.
...then plants itself in the registry’s Run key under the unassuming name “putty” so it survives a reboot.
Cruciferra adds an extra layer of sophistication by patching ZwQueryVirtualMemory hooks and by attempting to tamper with the NtManageHotPatch routine to hide the deletion of the file and neutralize integrity checks.
Crypters play an important role in the cybercriminal ecosystem as they allow bad actors to obfuscate their payloads, avoid detection, and improve malware delivery success rates.
The algorithm used to encrypt payloads and strings in each set of samples is different, and there is such a large variance of these algorithms, which means it is probably randomly generated (polymorphically).
...fake landing pages hosting ZIP files disguised as tax documents... One wave impersonated the US Social Security Administration...
The final payload is loaded into memory using a variant of Process Ghosting.
Process Ghosting is when malware creates a temporary file, marks it for pending deletion via NtSetInformationFile... Once the file handle is closed, the operating system deletes the file from disk while the section persists in memory.
Payloads are encoded in the binary using Base16 encoding with a custom character set... After the decoding stage, the payloads... are stored in a simple file structure.
It relies on indirect system calls and Import Address Table repair to reduce visibility...
This script first fingerprinted the user's system and reported the collected information to an actor-controlled server.
108 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A commercial crypter-as-a-service used to obfuscate and deliver malware while evading detection and analysis. It is written in Mono and uses indirect system calls, API/IAT unhooking, BYOVD-based EDR tampering, privilege escalation, persistence, DLL side-loading, and a customized Process Ghosting implementation to execute payloads with minimal forensic artifacts.
A sophisticated Mono-based crypter service used to obfuscate and deliver malware payloads while evading detection and analysis. It uses indirect system calls, API/IAT unhooking, BYOVD-based EDR tampering, privilege escalation, persistence, DLL side-loading, and a customized Process Ghosting implementation to execute payloads with minimal forensic artifacts.
A malware crypter service used to wrap and obfuscate payloads so they evade Windows security controls and EDR. The content says it uses DLL side-loading, sandbox/VM checks, BYOVD to terminate security processes, indirect syscalls, IAT repair, persistence mechanisms, and a customized Process Ghosting technique to execute payloads while minimizing disk artifacts and detection.
A crypter service used by multiple unrelated cybercriminal groups to conceal and deliver commodity malware. It uses DLL side-loading, EDR unhooking, Import Address Table patching, vulnerable signed drivers to disable kernel telemetry, numerous encryption routines, and a modified process ghosting technique with kernel anti-peek measures.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.