Cruciferra Crypter: How a $450-a-Month Service Hides RATs From EDR

Proofpoint's threat research team published an analysis of Cruciferra on July 20, 2026, written by Chris Wakelin, Georgi Mladenov, Kyle Cucci and colleagues. The report covers dozens of campaigns in which the tool was used to hide the real payload.

The headline finding is not the tooling itself but who uses it. Cruciferra is rented by several unrelated criminal clusters, so the same evasion layer sits in front of malware families that otherwise have nothing in common. Proofpoint also notes that Cruciferra appears to be an umbrella name covering several crypters bundled into one service, and that its analysis focuses on the variant it sees most often.

Researchers found both production and apparent test builds, some carrying debugging functionality and experimental features. That points to a service under active development rather than a static tool.

A crypter is a packaging tool that obfuscates a malicious payload so it survives contact with security controls long enough to run. It does not steal anything itself. Its whole job is to get something else past the door.

The category is old and mostly unremarkable. What separates Cruciferra, in Proofpoint's assessment, is the depth of the evasion stack and the variation between builds. It is written in Mono, the cross-platform implementation of the .NET runtime, and it treats endpoint tooling as an obstacle to be actively dismantled rather than simply avoided.

It is also sold openly. The operators advertise it as the underground's most lethal crypter on the Exploit forum, with tiered pricing from 450 to 2,000 US dollars a month depending on the feature set. It first went on sale in autumn 2025.

Execution always starts the same way. The victim opens an archive containing an executable and a DLL, runs the executable, and the DLL carrying Cruciferra's code is side-loaded. Before anything else happens, the tool checks whether it is running inside a sandbox or an analyst's virtual machine.

From there the evasion stack is unusually broad. Cruciferra drops a legitimate but vulnerable signed driver, most often GoFlyDrv.sys, and uses it to terminate endpoint security processes from kernel level. This is the bring-your-own-vulnerable-driver technique, and Proofpoint lists eight drivers with hashes that have been observed in this role.

Alongside that, it restores Windows API functions and Import Address Table entries that security products had hooked, and calls system functions indirectly to sidestep the hooks that remain. It suppresses Windows toast notifications and balloon tips so the user sees nothing. If it lacks administrator rights it attempts a UAC bypass, then writes a Run key entry with the innocuous value putty for persistence.

The payload itself is loaded through a modified Process Ghosting routine, which runs code from a file already deleted from disk, leaving nothing for a scanner to inspect.

The most distinctive part of the analysis concerns how payloads are protected. Cruciferra draws on more than 90 different encryption routines, and Proofpoint's point is that they are almost never complete algorithms.

Instead each routine is assembled from parts of others. A key schedule borrowed from one algorithm might be bolted onto a cipher core taken from another. The researchers assess that these combinations are probably generated polymorphically from elements of well-known hashing, pseudorandom number generation and cipher algorithms, given how much they vary between sample sets.

The consequence for defenders is direct. Static analysis and signature-based detection both assume something stable to match against, and this design removes it deliberately. Proofpoint's tracking has instead leaned on YARA rules combined with a quirk in the file metadata: Cruciferra-packed binaries carry randomly generated copyright, product and description fields following a recognisable pattern, such as a year followed by two to four invented words.

Delivery is by email in every case Proofpoint observed, and targeting is opportunistic rather than selective. Message volumes run from several hundred to several thousand per campaign.

Between late April and early June 2026, four campaigns were attributed to the Chinese-speaking cybercrime actor TA4922, using tax-themed lures impersonating the Indian Income Tax Department and the Government of India. Victims were driven to convincing replica tax portals hosting archives, and the chain ended in AsyncRAT. These campaigns were smaller, at up to 250 messages each. The Hacker News notes that TA4922 shows some overlap with the group tracked as Silver Fox, and that the same tax-lure activity was documented separately by Seqrite Labs under the name Operation DragonReturn.

Two other campaigns show the range. In May, emails impersonating the US Social Security Administration led to a disk image file that ultimately delivered XWorm and AdaptixC2. At the end of June, a lure built around bed bug complaints targeted hospitality and travel firms and delivered zgRAT.

Proofpoint's breakdown of observed campaign targeting puts financial services well ahead at 34 percent, followed by healthcare at 25 percent and government at 10 percent. Education accounts for 7 percent, with several other sectors at roughly 4 percent each.

Those proportions describe where the mail landed, not where compromise succeeded, and the targeting is explicitly opportunistic. A sector concentration in this data says more about who receives high volumes of unsolicited financial and administrative correspondence than about deliberate selection.

The payload list matters more than the sector list for risk assessment. These families have all been seen behind it:

• Remote access trojans: AsyncRAT, Remcos, XWorm, zgRAT, ValleyRAT (also known as Winos4.0)
• Infostealers and keyloggers: Agent Tesla, DarkCloud Stealer, Phantom Stealer, Snake Keylogger
• Form grabbers: Formbook and XLoader

Those are credential theft and remote access tools, which means the realistic outcome is stolen accounts and a foothold sold onward.

Driver blocklisting is the highest-value control here. The BYOVD step is what neutralises endpoint tooling, and it depends on loading a known vulnerable signed driver. Microsoft's vulnerable driver blocklist and equivalent application control policies remove that step, and Proofpoint published hashes for the eight drivers it observed.

The persistence and stealth artifacts are cheap to alert on because they are specific.

Persistence
  Software\Microsoft\Windows\CurrentVersion\Run          value: putty

Notification suppression
  Software\Microsoft\Windows\CurrentVersion\PushNotifications   ToastEnabled
  Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced   Balloon
  Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced   ShowInfoTip

Most frequently abused driver
  GoFlyDrv.sys   2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a

A Run key value of putty is not something a legitimate estate produces at scale, and neither is the programmatic disabling of toast notifications and balloon tips.

On the delivery side, the chain depends on the user opening an archive or disk image and running the executable inside it. Blocking or quarantining disk image attachments, restricting shortcut files arriving from outside, and constraining PowerShell all break the chain earlier than any endpoint control. Detection engineering should also expect the payload to be unnameable at the point of entry, since the crypter is the constant and the malware behind it is not.