Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
The China-linked cybercrime group behind tax-themed phishing campaigns is utilizing a sophisticated crypter service called Cruciferra to deliver a wide range of malware, including remote access trojans and information stealers. Cruciferra employs advanced techniques like BYOVD-based EDR tampering, process ghosting, and privilege escalation to evade detection and maximize malware delivery success. The group, linked to threat actors like TA4922 and Silver Fox, has been targeting sectors such as finance, healthcare, and government, primarily through phishing campaigns.
The China-linked cybercrime group responsible for deploying tax-themed phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams is now leveraging a sophisticated crypter service called Cruciferra. According to a recent analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a diverse array of remote access trojans (RATs) and information stealer malware.
"Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts," the enterprise security company stated. These techniques include using indirect system calls, API and Import Address Table (IAT) unhooking, bring-your-own-vulnerable-driver (BYOVD)-based EDR tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting used to execute payloads while minimizing forensic artifacts.
Crypters play a crucial role in the cybercriminal ecosystem by obscuring payloads, avoiding detection, and boosting malware delivery success rates. Cruciferra distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection. The service has been advertised on the cybercrime underground as the "most lethal crypter" for $450 to $2,000 a month, initially available in fall 2025.
Several commodity malware families, including Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT, are distributed via Cruciferra. Campaigns leveraging the crypter have utilized phishing as the primary initial access vector, with the tool incorporating the flexibility to either drop an encrypted payload to disk or download it from a staging server. The activity is assessed to be opportunistic, reaching anywhere between hundreds and thousands of messages per campaign.
The primary targets include financial services, healthcare, government, education, and manufacturing sectors. One such campaign has been attributed to Chinese-speaking cybercrime actor TA4922, which shares some level of overlap with another prolific threat group called Silver Fox. These campaigns involve employing tax-themed lures to drive victims to attacker-controlled landing pages hosting ZIP files to deliver malware. Four such campaigns have been identified between April and early June 2026.
Other campaigns utilizing Cruciferra include emails impersonating the U.S. Social Security Administration (SSA) to deliver XWorm and AdaptixC2 (May 2026), and email using themes related to bed bugs and guest complaints to target organizations in the hospitality and travel industries and deliver zgRAT (late June 2026). Regardless of the campaign, Cruciferra is always executed via DLL side-loading, while leveraging evasion and anti-analysis techniques to fly under the radar. This includes hiding console windows, unhooking Windows API functions to reduce visibility, indirect system calls, disabling user notifications, and the abuse of the "GoFlyDrv.sys" driver as part of a BYOVD attack to terminate security processes.
"Cruciferra checks if it is running with Administrator privileges, and if not, attempts to elevate its privileges by bypassing UAC using the COM Elevation Moniker," Proofpoint explained. "Additionally, Cruciferra establishes persistence by writing to the registry Software\Microsoft\Windows\CurrentVersion\Run key with a default value of 'putty.' This ensures Cruciferra runs after system reboot." The final payload is loaded into memory using a variant of Process Ghosting, which, at a high level, refers to an advanced malware evasion technique on Windows where malicious code is executed from a temporary file that is deleted from the disk before the process starts. This, in turn, blinds security products as there is no "file" to scan.
Cruciferra adds an extra layer of sophistication by patching ZwQueryVirtualMemory hooks and by attempting to tamper with the NtManageHotPatch routine to hide the deletion of the file and neutralize integrity checks. The group is actively targeting sectors such as finance, healthcare, and government, and is utilizing a highly adaptable approach to evade detection and maximize malware delivery success.