Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
Cruciferra crypter uses BYOVD and Process Ghosting to hide Windows malware.
A sophisticated crypter service named Cruciferra, written in Mono, is being used by various cybercriminal groups to obfuscate and deliver malware. It employs advanced evasion techniques like BYOVD-based EDR tampering and Process Ghosting, making analysis difficult. Advertised as the 'most lethal crypter,' it supports numerous malware families and has been linked to China-linked threat actors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Proofpoint?
Get an email when a new story names Proofpoint, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Cruciferra crypter represents a significant escalation in attacker evasion capabilities by combining Bring Your Own Vulnerable Driver (BYOVD) attacks with Process Ghosting to neutralize endpoint detection and response (EDR) tools before deploying malware. By exploiting legitimate but vulnerable drivers, attackers can disable or tamper with security controls that organizations rely on as a primary defense layer. This matters because it renders traditional endpoint security investments ineffective, leaving organizations blind to active intrusions. The crypter's availability as a service to multiple threat actor groups — including China-linked actors — dramatically broadens the attack surface for enterprises and critical infrastructure worldwide.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Agent Tesla
- malware — AsyncRAT
- malware — DarkCloud Stealer
- malware — Formbook
- malware — Phantom Stealer
- malware — Remcos RAT
- malware — Snake Keylogger
- malware — ValleyRAT
- malware — XLoader
- malware — XWorm
- malware — zgRAT
- malware — AdaptixC2