Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors
Do Son 
A single crypter is now hiding malware for many unrelated criminal crews at once. Proofpoint researchers call it Cruciferra. The Cruciferra crypter service wraps remote access trojans and infostealers to slip them past security controls. It also markets itself on a criminal forum as “the underground’s most lethal crypter.”
At a glance
| Malware family | Cruciferra, a crypter (malware-packing) service. An “umbrella” name for bundled crypters |
| Threat actor | Multiple unrelated actors. Confirmed use by Chinese-speaking actor TA4922 |
| Target / victims | Opportunistic. Financial services, healthcare, and government seen most often |
| Delivery vector | Email, using archives with an EXE plus DLL for side-loading |
| Key capabilities | EDR tampering, indirect syscalls, tweaked Process Ghosting, 90+ custom crypto routines |
| Source | Proofpoint Threat Insight; supporting reporting from Deception.Pro |
TL;DR
Proofpoint is tracking Cruciferra, a crypter sold as a service since fall 2025. Many unrelated actors use it to hide payloads like AsyncRAT, XWorm, and zgRAT. The tool packs heavy evasion, including EDR tampering and a modified Process Ghosting technique.
Why it matters
Crypters sit at the front of the attack chain. They hide the real payload and boost delivery success. According to Proofpoint, crypters “conceal malicious payloads, evade security controls, and improve malware delivery success rates.” Because the Cruciferra crypter service serves many crews, one tool now lifts the success rate of dozens of campaigns.
Pricing shows a maturing business, too. Proofpoint reports tiered builds that run from $450 to $2,000 per month. New samples also appear often. On 9 July 2026, researchers saw a fresh packed sample uploaded every few minutes.
Delivery
Cruciferra spreads through email campaigns. Volumes range from several hundred to thousands of messages each. Lures lean on tax and government themes. For example, TA4922 impersonated India’s Income Tax Department to deliver AsyncRAT. Another wave spoofed the U.S. Social Security Administration and led to XWorm. A late-June campaign used fake guest complaints against hospitality targets.
Infection chain
Side-loading the crypter
The chain starts with a ZIP or similar archive. Inside sit an executable and a DLL. When the victim runs the EXE, the DLL loads through DLL side-loading. That DLL holds the Cruciferra code.
Checking the room first
Before dropping the payload, Cruciferra checks its surroundings. Its main job is to confirm the host is not a sandbox or analyst machine. Only then does it decode and run the final malware.
Evasion and payload behavior
The Cruciferra crypter service packs a deep evasion stack. It uses indirect system calls to dodge inline hooks. It unhooks API functions and repairs the Import Address Table. It also drops a vulnerable driver to disable defenses. Proofpoint notes it “often abuses the legitimate (but vulnerable) GoFlyDrv.sys driver” to terminate EDR processes.
Custom crypto and Process Ghosting
Payload protection is a standout feature. The crypter can pick from over 90 encryption routines. Most are stitched together from pieces of known algorithms. This variation frustrates static and signature-based defenses. For loading, Cruciferra uses a tweaked Process Ghosting method. It runs a payload from a file that the system deletes before scanners can inspect it. Two extra tricks hide the ghosted memory from EDR checks.
Delivered payloads
Cruciferra hides a broad menu of commodity malware. Observed payloads include Agent Tesla, AsyncRAT, DCRAT, Formbook, XLoader, Remcos, Snake Keylogger, ValleyRAT, XWorm, and zgRAT. In short, it is a shared delivery layer for many infostealers and RATs.
Attribution
Proofpoint does not tie Cruciferra to a single group. Instead, multiple unrelated actors buy and use it. The link to TA4922, a Chinese-speaking cybercrime actor, is stated as confirmed. Broader campaign attribution stays open, since targeting is opportunistic.
Defense and detection guidance
Focus on behavior, not just signatures. You can read the full Proofpoint analysis of the Cruciferra crypter service for indicators.
- Alert on EXE-plus-DLL archives that trigger DLL side-loading from user folders.
- Monitor for vulnerable-driver drops and sudden EDR process terminations.
- Watch for Run-key persistence and registry edits that disable user notifications.
- Hunt PE files with odd, random-word Copyright and Product metadata fields.
- Block tax- and government-themed phishing that pushes archives or disk-image files.
Treat indicators here as descriptive only. The named drivers and metadata quirks help hunting, yet attackers rotate them. Layered detection and prompt patching remain your best defense.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
