“the underground's most lethal crypter,” reads Cruciferra’s own boast on dark-web forums, and Proofpoint’s July 20 research traces exactly how that claim is being operationalized across dozens of malware campaigns.
DLL side‑loading and decoy exports: the primary delivery chain
Proofpoint found Cruciferra consistently executed via DLL side‑loading. Victims received ZIP files pairing a legitimate executable with a malicious DLL; running the legitimate executable caused the side‑loaded DLL to inspect the environment and then drop the real payload. The malicious DLLs contained hundreds of decoy exported functions that pointed to junk code, with only one or two exports calling into the genuine routine — a deliberate effort to frustrate analysis and signature rules.
Kernel‑driver abuse and a BYOVD model
Before final execution, Cruciferra unhooked endpoint detection and response (EDR) monitoring at multiple levels. The crypter patched the Import Address Table, read a clean copy of ntdll.dll to source indirect syscalls, and disabled kernel‑level telemetry by loading a vulnerable signed driver such as GoFlyDrv.sys and issuing IOCTL commands to terminate security processes. Proofpoint describes this bring‑your‑own‑vulnerable‑driver (BYOVD) approach as mirroring techniques seen in the GentleKiller framework that the Gentlemen ransomware gang distributes to affiliates.
Process ghosting, ZwQueryVirtualMemory and NtManageHotPatch
For execution Cruciferra adapts classic process ghosting. The traditional method creates a temporary file marked for deletion, populates it with the payload, and uses it as the backing image for a suspended process so a running process is backed by an image that no longer exists on disk. Cruciferra adds two anti‑inspection layers: it patches ZwQueryVirtualMemory so EDR queries against ghosted memory return sanitized results, and it neuters NtManageHotPatch — the kernel function that can validate a loaded image against its on‑disk counterpart. Together, those additions are designed to make memory and kernel checks report clean images even when the running process is malicious.
Payload diversity: 90+ mix‑and‑match cryptographic routines
Proofpoint reports the crypter stores payloads in the binary’s .reloc section and unpacks them using one of more than 90 encryption routines. Those routines are assembled from parts of established algorithms — including Keccak, Threefish and Feistel variants — so the cipher covering one sample rarely matches the next. The modular, mix‑and‑match design supports variable packing across otherwise similar samples and increases the difficulty of producing a single, reusable detection signature.
Who used Cruciferra, which lures succeeded, and who was targeted
Proofpoint attributed multiple campaigns using Cruciferra to the Chinese‑speaking group TA4922, which employed tax‑themed lures impersonating the Indian Income Tax Department to deliver AsyncRAT between late April and early June. Separate May campaigns spoofed the US Social Security Administration to deliver XWorm, and a late‑June operation used bed‑bug guest‑complaint lures against hospitality organizations to drop zgRAT. Across observed activity, Cruciferra has underpinned delivery of AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.
Observed targeting was opportunistic but shows sectoral concentration: financial services accounted for 34% of observed targets, healthcare 25% and government 10%. Proofpoint also noted production and apparent testing samples — and reported that new Cruciferra‑packed samples appeared on VirusTotal every few minutes on July 9.
What this means for technologists, procurement leaders, and enterprises
- Technologists and security teams should watch for DLL side‑loading chains, decoy export tables, and indicators of kernel‑level tampering such as the use of known vulnerable signed drivers (for example, GoFlyDrv.sys) and IOCTL activity that terminates security processes.
- Procurement and asset owners should be attentive to BYOVD risk: signed drivers with known vulnerabilities are being repurposed as attack primitives, and access to commercial crypters — offered in tiered plans from $450 to $2,000 a month — lowers the barrier for diverse criminal groups to adopt advanced evasion techniques.
- Enterprises in financial services, healthcare and government should factor the observed sector targeting and opportunistic lures — tax notices, Social Security messages, and hospitality guest complaints — into phishing awareness and ZIP‑delivery controls.
Proofpoint’s findings sketch an ecosystem in active development: a commercial crypter that advertises itself as lethal, a BYOVD model that reuses signed drivers to disable kernel telemetry, modular cryptography to frustrate signature detection, and process ghosting hardened with kernel hooks to thwart inspection. The combination — widespread availability on a crime forum since autumn 2025, recurring VirusTotal sightings on July 9, and multiple distinct campaigns through June 2026 — leaves a clear operational question: how quickly can defenders detect kernel‑level manipulation and ephemeral, heavily‑obfuscated payloads once those techniques are commodified and offered for monthly subscription?
Source: https://www.infosecurity-magazine.com/news/cruciferra-crypter-process-ghosting/
