Do Son Proofpoint details the Cruciferra crypter service that cloaks RATs and infostealers using BYOVD EDR tampering and 90+ custom encryption routines.
process ghosting
At first glance, CherryLoader deceives with a veneer of innocence, masquerading as the legitimate CherryTree note-taking application