Sophisticated crypter service Cruciferra evades detection with advanced techniques

A sophisticated crypter service known as Cruciferra has been documented employing advanced techniques like process ghosting and kernel-driver abuse to cloak commodity malware. This service is being utilized by multiple, unrelated cyber-criminal groups to deliver a variety of malicious payloads, according to a recent report by Infosecurity Magazine.

Cruciferra, first offered for sale in autumn 2025, underpins dozens of campaigns delivering malware such as AsyncRAT, Agent Tesla, and Remcos. The service offers tiered access ranging from $450 to $2,000 per month and is actively developed, with new samples appearing frequently. Attack methods include DLL side-loading, where a legitimate executable is paired with a malicious DLL. Before execution, Cruciferra unhooks endpoint detection and response (EDR) monitoring, patches the Import Address Table, and disables kernel-level telemetry by abusing vulnerable signed drivers.

Payloads are unpacked using over 90 mix-and-match encryption routines. For final execution, it uses a modified process ghosting technique, enhanced with kernel anti-peek measures to sanitize memory queries and disable image validation. Observed campaigns have targeted financial services (34%), healthcare (25%), and government (10%), with notable attacks impersonating the Indian Income Tax Department and the US Social Security Administration.

Source: Infosecurity Magazine