Proofpoint has disclosed new findings on an advanced crypter service known as Cruciferra, revealing that it is being used by multiple cybercriminal groups to distribute a wide range of Windows malware while employing sophisticated defense evasion techniques. According to the security company, the China linked cybercrime group behind income tax themed phishing campaigns targeting Indian taxpayers, tax professionals, and corporate finance teams has also been observed using the service. Proofpoint said Cruciferra has been adopted by several unrelated threat clusters to deliver remote access trojans and information stealing malware, making it a versatile malware delivery platform across different campaigns. Researchers described the crypter as being written in Mono and equipped with numerous capabilities intended to evade detection, complicate malware analysis, and reduce the effectiveness of incident response efforts. The malware incorporates indirect system calls, API and Import Address Table unhooking, bring your own vulnerable driver techniques for endpoint security tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting to execute malicious payloads while minimizing forensic evidence.
Crypters play an important role within the cybercrime ecosystem because they conceal malicious payloads from security software and improve the success rate of malware delivery. Proofpoint explained that Cruciferra goes beyond conventional crypters by supporting multiple custom encryption routines that appear to be dynamically generated from established cryptographic algorithms. This results in significant variation between malware samples, making static analysis and signature based detection considerably more difficult. Researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci noted that each sample uses different encryption methods derived from combinations of well known hashing, pseudo random number generation, and cipher algorithms, creating polymorphic payloads that continually change their characteristics. The crypter has reportedly been promoted on underground cybercrime forums as the most lethal crypter and has been offered through subscription plans ranging from 450 dollars to 2,000 dollars per month since late 2025. Malware families distributed through the service include Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT.
According to Proofpoint, phishing remains the primary method used to distribute Cruciferra, with attackers either dropping encrypted payloads directly onto victim systems or downloading them from staging servers after initial compromise. The campaigns have targeted organizations across financial services, healthcare, government, education, manufacturing, hospitality, and travel sectors, with individual campaigns reaching hundreds or even thousands of recipients. One campaign has been attributed to the Chinese speaking cybercrime actor TA4922, which shares operational similarities with the Silver Fox threat group. In these attacks, tax themed phishing emails direct victims to attacker controlled websites hosting ZIP archives that ultimately deliver malware. Proofpoint identified four such campaigns between April and early June 2026. Researchers also noted that the activity had previously been documented by Seqrite Labs and Cyderes Howler Cell, with Seqrite tracking the operation under the name Operation DragonReturn. Additional campaigns using Cruciferra have impersonated the United States Social Security Administration to distribute XWorm and AdaptixC2, while another campaign targeting hospitality and travel organizations used emails referencing bed bug complaints to deliver zgRAT.
Proofpoint stated that regardless of the campaign, Cruciferra consistently relies on DLL side loading to execute its components while applying numerous anti analysis techniques designed to remain undetected. These include hiding console windows, unhooking Windows API functions, using indirect system calls, disabling user notifications, and abusing the GoFlyDrv.sys driver as part of a bring your own vulnerable driver attack to terminate security processes. The crypter also checks whether it is running with administrator privileges and attempts to bypass User Account Control through the COM Elevation Moniker if elevated permissions are unavailable. To maintain persistence, it creates a registry entry under the Windows Run key using the default value “putty” so it automatically launches after a system restart. The final malware payload is loaded into memory using a customized version of Process Ghosting, an advanced Windows evasion technique that executes malicious code from a temporary file deleted before the process begins, leaving no file for security software to inspect. Proofpoint added that Cruciferra further enhances its stealth capabilities by patching ZwQueryVirtualMemory hooks and attempting to manipulate the NtManageHotPatch routine to conceal file deletion and bypass integrity verification, making it one of the more sophisticated crypter services currently observed in cybercrime operations.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
