Cruciferra

tool · tool:cruciferra-crypter

Mono/.NET crypter-as-a-service (advertised on underground forums since late 2025) using 90+ polymorphic cipher routines, a modified process-ghosting loader, ZwQueryVirtualMemory/NtManageHotPatch tampering, indirect syscalls from a clean ntdll copy, and BYOVD EDR termination via a vulnerable signed driver (e.g. GoFlyDrv.sys); packs commodity RATs/infostealers for multiple criminal groups. Proofpoint attributes four Cruciferra-packed AsyncRAT campaigns to China-nexus TA4922 (Proofpoint, 2026-07-20).

Coverage timeline

first 2026-07-21 → last 2026-07-21

Peak priority

notable

1 notable

Sources cited

2 hosts

Sections touched

active-threats

Co-occurring entities

see Related entities below

ATT&CK techniques

pinned v19.1 · see below

Hunting pivots

ATT&CK techniques

T1027 T1027.002 T1055 T1685

ATT&CK techniques

4 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Privilege Escalation TA0004

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · ATT&CK page ↗

T1027.002Obfuscated Files or Information: Software Packing×1

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.

Evidence: 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · ATT&CK page ↗

T1055Process Injection×1

Evidence: 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · ATT&CK page ↗

Story timeline

2026-07-21Cruciferra: a crypter-as-a-service using kernel-aware process ghosting and BYOVD EDR termination, tied to China-nexus TA4922
active-threatsProofpoint details Cruciferra, a commercial crypter that hides payloads with process ghosting and kills EDR via a vulnerable signed driver

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

used by

TA4922
actoractor:ta4922evidence · 2026-07-21
Proofpoint attributes four Cruciferra-packed AsyncRAT campaigns to TA4922

Where this entity is cited

active-threats1

Source distribution

infosecurity-magazine.com1 (50%)
proofpoint.com1 (50%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

TA4922×1
actoractor:ta4922linked

All cited sources (2)

Entries about Cruciferra (1)

2026-07-21 · view entry permalink →

NOTABLENATOB2

Cruciferra: a crypter-as-a-service using kernel-aware process ghosting and BYOVD EDR termination, tied to China-nexus TA4922

Proofpoint's analysis details Cruciferra, a Mono/.NET-based crypter-as-a-service advertised on underground forums since late 2025 and used by several unrelated criminal groups to pack commodity payloads (AsyncRAT/DCRAT, Agent Tesla, XWorm, Formbook/XLoader, Remcos, Snake Keylogger and others). Its distinguishing feature is an evasion stack aimed squarely at endpoint defenses (Proofpoint, 2026-07-20). Payloads are encrypted with one of over 90 polymorphic cipher routines assembled from primitives such as Keccak, Feistel, SPECK and Threefish and stored Base16-encoded in the PE's .reloc section, so no two samples share an identical routine. Execution uses a variant of process ghosting: a temporary file is marked for deletion, then mapped as a PE image section (NtCreateSection with SEC_IMAGE) before the delete completes, leaving a running process whose backing image is never scannable on disk. Cruciferra hardens that trick with two anti-EDR steps — patching ZwQueryVirtualMemory so endpoint tools misread mapped memory, and neutering NtManageHotPatch to defeat image-integrity validation — alongside Import Address Table unhooking and indirect syscalls: per Proofpoint, "the malware reads a clean copy of ntdll.dll on disk and stores all stub pointers in a global structure for later usage." For EDR/AV termination it loads a legitimate-but-vulnerable signed driver (Proofpoint names GoFlyDrv.sys among the alternates) and issues control codes to kill security processes — classic BYOVD.

Attribution matters here: "Proofpoint observed four campaigns attributed to Chinese-speaking cybercrime actor TA4922 using Cruciferra to ultimately deliver AsyncRAT," behind landing pages mimicking government tax portals, against finance, healthcare and government targets.

the malware reads a clean copy of ntdll.dll on disk and stores all stub pointers in a global structure for later usage.

Proofpoint observed four campaigns attributed to Chinese-speaking cybercrime actor TA4922 using Cruciferra to ultimately deliver AsyncRAT.

Proofpoint Threat Insight 2026-07-20

threat21 Jul 04:41Zmulti-sourceOpen finding ↗

Sources: Proofpoint Threat Insight · Infosecurity Magazine