[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOS4OXqL7m8ovy6ewxDnh5Vwd3xgAYJi0mpf5QfT3jPk":3},{"article":4,"iocs":54,"watch_terms":81,"solutions":82,"lesson":176},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"25e1384a-6347-4482-8608-0647984433ce","Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware","cruciferra-crypter-uses-byovd-and-process-ghosting-to-hide-windows-malware-7c7cdd","The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote","A sophisticated crypter service named Cruciferra, written in Mono, is being used by various cybercriminal groups to obfuscate and deliver malware. It employs advanced evasion techniques like BYOVD-based EDR tampering and Process Ghosting, making analysis difficult. Advertised as the 'most lethal crypter,' it supports numerous malware families and has been linked to China-linked threat actors.","Cruciferra crypter uses BYOVD and Process Ghosting to hide Windows malware.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcruciferra-crypter-uses-byovd-and.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhBorVFXLroQ9D9Ao8QPsDAQpmoMeD2ciyHIBw3YYRHLBLAeDIjFZ6V9lzrrtmNq3KrIRqHhJUfKAx2sXIsMYCjyFzRV9awIVSLOuujkMY8hOeUkaNlFgM421aS8pVQaiLmjwKcNNLy5TcU389YEAPfCnB8uVeFtUY9BCJ0lz4IjQoD2UZp9pVDP7IzLurf\u002Fs1600\u002Fmalware-hacker.jpg","2026-07-27T10:51:45+00:00","2026-07-27T12:00:22.143553+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Cruciferra","product",{"name":21,"type":22},"Proofpoint","vendor",{"name":24,"type":25},"TA4922","threat_actor",{"name":27,"type":25},"Silver Fox",{"name":29,"type":30},"Operation DragonReturn","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,60,62,64,66,68,70,72,74,76,78],{"type":35,"value":56,"context":57},"Agent Tesla","Commodity malware family distributed via Cruciferra",{"type":35,"value":59,"context":57},"AsyncRAT",{"type":35,"value":61,"context":57},"DarkCloud Stealer",{"type":35,"value":63,"context":57},"Formbook",{"type":35,"value":65,"context":57},"Phantom Stealer",{"type":35,"value":67,"context":57},"Remcos RAT",{"type":35,"value":69,"context":57},"Snake Keylogger",{"type":35,"value":71,"context":57},"ValleyRAT",{"type":35,"value":73,"context":57},"XLoader",{"type":35,"value":75,"context":57},"XWorm",{"type":35,"value":77,"context":57},"zgRAT",{"type":35,"value":79,"context":80},"AdaptixC2","Malware delivered in SSA impersonation campaign",[21,18],{"controls":83,"vendors":170},[84,113,141],{"slug":85,"name":86,"problem":87,"products":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":53,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":142,"name":143,"problem":144,"products":145},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[146,154,162],{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":163,"vendor_name":164,"vendor_logo":165,"product_slug":166,"product_name":167,"url":168,"description":169},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[171],{"slug":172,"name":21,"logo_path":173,"roles":174},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[175],"reported_by",{"slug":177,"title":178,"body":179,"framework_refs":180,"framework_notes":193},"cruciferra-crypter-bypasses-edr-using-byovd-and-process-ghosting-techniques","Cruciferra Crypter Bypasses EDR Using BYOVD and Process Ghosting Techniques","The Cruciferra crypter represents a significant escalation in attacker evasion capabilities by combining Bring Your Own Vulnerable Driver (BYOVD) attacks with Process Ghosting to neutralize endpoint detection and response (EDR) tools before deploying malware. By exploiting legitimate but vulnerable drivers, attackers can disable or tamper with security controls that organizations rely on as a primary defense layer. This matters because it renders traditional endpoint security investments ineffective, leaving organizations blind to active intrusions. The crypter's availability as a service to multiple threat actor groups — including China-linked actors — dramatically broadens the attack surface for enterprises and critical infrastructure worldwide.",[181,182,183,184,185,186,187,188,189,190,191,192],"CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-83: Guide to Malware Incident Prevention and Handling","NIST CM-7: Least Functionality (restrict unauthorized drivers)","NIST SI-3: Malicious Code Protection","NIST DE.CM-4: Malicious code detection","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1055.015: Process Ghosting","MITRE ATT&CK T1068: Exploitation for Privilege Escalation (BYOVD)","Microsoft HVCI (Hypervisor-Protected Code Integrity) Guidance","NIST SP 800-61: Computer Security Incident Handling Guide",{}]