Cruciferra: a crypter-as-a-service using kernel-aware process ghosting and BYOVD EDR termination, tied to China-nexus TA4922
Proofpoint's analysis details Cruciferra, a Mono/.NET-based crypter-as-a-service advertised on underground forums since late 2025 and used by several unrelated criminal groups to pack commodity payloads (AsyncRAT/DCRAT, Agent Tesla, XWorm, Formbook/XLoader, Remcos, Snake Keylogger and others). Its distinguishing feature is an evasion stack aimed squarely at endpoint defenses (Proofpoint, 2026-07-20). Payloads are encrypted with one of over 90 polymorphic cipher routines assembled from primitives such as Keccak, Feistel, SPECK and Threefish and stored Base16-encoded in the PE's .reloc section, so no two samples share an identical routine. Execution uses a variant of process ghosting: a temporary file is marked for deletion, then mapped as a PE image section (NtCreateSection with SEC_IMAGE) before the delete completes, leaving a running process whose backing image is never scannable on disk. Cruciferra hardens that trick with two anti-EDR steps — patching ZwQueryVirtualMemory so endpoint tools misread mapped memory, and neutering NtManageHotPatch to defeat image-integrity validation — alongside Import Address Table unhooking and indirect syscalls: per Proofpoint, "the malware reads a clean copy of ntdll.dll on disk and stores all stub pointers in a global structure for later usage." For EDR/AV termination it loads a legitimate-but-vulnerable signed driver (Proofpoint names GoFlyDrv.sys among the alternates) and issues control codes to kill security processes — classic BYOVD.
Attribution matters here: "Proofpoint observed four campaigns attributed to Chinese-speaking cybercrime actor TA4922 using Cruciferra to ultimately deliver AsyncRAT," behind landing pages mimicking government tax portals, against finance, healthcare and government targets.
the malware reads a clean copy of ntdll.dll on disk and stores all stub pointers in a global structure for later usage.
Proofpoint observed four campaigns attributed to Chinese-speaking cybercrime actor TA4922 using Cruciferra to ultimately deliver AsyncRAT.
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Privilege Escalation TA0004
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1027.002Obfuscated Files or Information: Software Packing
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.