Cruciferra was first made available for sale in fall 2025 and has been advertised on the cybercrime underground as the "most lethal crypter" for $450 to $2,000 a month, according to researchers who tracked its use across multiple criminal clusters.
Proofpoint’s technical portrait of Cruciferra
Enterprise security firm Proofpoint published an analysis last week that lays out a detailed technical profile of Cruciferra. "Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts," the company wrote. The crypter is modular and purpose-built to protect payloads through obfuscation and polymorphic encryption, with many samples employing custom, dynamically derived routines assembled from "elements of well-known hashing, PRNG, and cipher algorithms," researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci observed.
Proofpoint notes Cruciferra can either drop an encrypted payload to disk or download it from a staging server, and it supports a wide set of anti-analysis controls such as hiding console windows, unhooking Windows API functions, and using indirect system calls to reduce visibility to defensive tools.
BYOVD abuse and the GoFlyDrv.sys driver
A standout capability is Cruciferra’s use of BYOVD — bring-your-own-vulnerable-driver-based EDR tampering — to interfere with endpoint defenses. The crypter abuses a driver named "GoFlyDrv.sys" as part of a BYOVD attack to terminate security processes, a technique called out explicitly by the researchers. Proofpoint documented that Cruciferra also performs API and Import Address Table (IAT) unhooking and disables user notifications to further frustrate detection and response.
Process Ghosting, memory-only payloads, and anti-forensics
Cruciferra executes final payloads using a customized variant of Process Ghosting — a technique that runs malicious code from a temporary file deleted before the process starts, leaving little or no file artifact for scanners to inspect. The crypter goes further by patching ZwQueryVirtualMemory hooks and attempting to tamper with the NtManageHotPatch routine "to hide the deletion of the file and neutralize integrity checks," Proofpoint reported. Together these measures aim to blind memory inspection and integrity verifications that defenders rely upon.
Persistence and privilege escalation are baked into the toolset: Cruciferra checks for Administrator privileges and, if absent, "attempts to elevate its privileges by bypassing UAC using the COM Elevation Moniker," then establishes persistence by writing to the registry key Software\Microsoft\Windows\CurrentVersion\Run with a default value of "putty." The crypter is "always executed via DLL side-loading," Proofpoint added.
TA4922, Operation DragonReturn, and observed campaigns
The crypter has been employed across a range of opportunistic phishing campaigns. Proofpoint links a China‑linked cybercrime group using income-tax-themed lures against Indian taxpayers, tax professionals, and corporate finance teams to Cruciferra. One attributed actor, the Chinese-speaking cluster TA4922 — which shares overlap with a group called Silver Fox — used tax-themed lures that led victims to attacker-controlled landing pages hosting ZIP files; four such campaigns were identified between April and early June 2026.
Seqrite Labs and Cyderes Howler Cell documented this activity earlier in July 2026, with Seqrite tracking it under the name Operation DragonReturn. Other observed campaigns employing Cruciferra include emails impersonating the U.S. Social Security Administration (May 2026) that delivered XWorm and AdaptixC2, and hospitality-targeted messages about bed bugs and guest complaints (late June 2026) that delivered zgRAT.
Proofpoint emphasizes that Cruciferra has been used by "various unrelated cybercriminal threat clusters" to distribute a wide array of commodity remote access trojans and information stealers, including Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT. Campaign volumes have ranged from hundreds to thousands of messages per campaign, and primary targets include financial services, healthcare, government, education, and manufacturing sectors.
What this means for security teams, affected sectors, and end users
- Technologists and security teams: Watch for DLL side‑loading, BYOVD activity involving drivers such as GoFlyDrv.sys, registry persistence with the Run key value "putty," and memory‑only execution patterns that attempt to evade ZwQueryVirtualMemory and hot‑patch integrity checks.
- Financial services, healthcare, government, education, and manufacturing: Expect opportunistic, high-volume phishing that can deliver multiple commodity RATs and stealers through the same crypter service; campaigns have used tax themes, SSA impersonation, and industry-specific lures such as hospitality complaints.
- End users targeted by tax‑themed and impersonation lures: Be wary of ZIP attachments and landing pages served by unsolicited emails — campaigns have been documented that specifically target taxpayers, tax professionals, corporate finance teams, and consumers with credible-seeming messages.
Proofpoint’s concluding assessment captures the practical threat: "While crypters have long been used to evade detection and increase malware delivery and execution success rates, Cruciferra distinguishes itself through its extensive and unique defense‑evasion capabilities, modular design, and highly customized and varied approach to payload protection." Its availability as a paid service means a single, sophisticated evasion toolkit can be leveraged by many criminal clusters — a multiplication factor defenders must reckon with.