Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
Summary: Proofpoint analyzed a crypter service called Cruciferra, written in Mono and sold on the cybercrime underground for $450 to $2,000 a month since fall 2025, which uses indirect system calls, API and IAT unhooking, BYOVD-based EDR tampering, UAC bypass via the COM Elevation Moniker, and a customized Process Ghosting variant to hide payloads. It has been used by unrelated criminal clusters to deliver Agent Tesla, AsyncRAT, Formbook, Remcos RAT, ValleyRAT, XLoader and other commodity malware, with one campaign attributed to Chinese-speaking actor TA4922 using tax-themed lures against Indian taxpayers across four campaigns between April and early June 2026.
Why it matters: Cruciferra abuses the GoFlyDrv.sys driver to terminate security processes and executes payloads from a file deleted before the process starts, so there is no file for your endpoint tooling to scan and the EDR agent may already be dead by the time the payload runs.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026