Cybercriminals are renting a malware-as-a-service (MaaS) tool called Cruciferra to hide infostealers and remote access trojans (RATs) from security software.
The service wraps harmful files in layers of encryption, so antivirus and endpoint detection tools struggle to spot them. It is now active in many campaigns around the world.
Cruciferra is a “crypter,” a tool that scrambles a malicious file and unpacks it only when it runs on a victim’s computer. Buyers pay a monthly fee, and Proofpoint reports prices from $450 to $2,000 depending on the features.
The seller has advertised it on underground forums since fall 2025, which makes it easy for even low-skilled criminals to use.
ESET Research noted that the service has been busy. Since January 2026, ESET says it has blocked over 700,000 compromise attempts linked to Cruciferra.
Türkiye, Greece, and Spain were hit hardest. ESET also found that the service, sold since October 2025, is a rebrand of the long-running KGB cryptor, so its operators are not beginners.
Hackers Abuse Cruciferra Malware-as-a-Service
The crypter’s best trick is its payload protection. Proofpoint found more than 90 encryption routines, most built from pieces of well-known algorithms. Each batch of samples looks different from the last, which breaks signature-based detection.
Researchers also say Cruciferra seems to be an umbrella name for several crypters sold in one package. Infections start with an email, a fake tax page, or a link to an archive. The victim opens a ZIP file holding an executable and a DLL.
Cruciferra always runs through DLL side-loading, so the clean executable quietly loads the malicious DLL. Before doing anything else, it checks for a sandbox or an analyst’s virtual machine.
The DLL is also stuffed with hundreds or thousands of fake exported functions to slow down researchers. This is similar to the crypter that can kill EDR that our team covered earlier.
Next, it goes after the defenses on the machine. Cruciferra removes the monitoring hooks that security tools place in Windows functions, hides console windows, and turns off Windows notification pop-ups.
It also drops a signed but vulnerable driver, often GoFlyDrv.sys, and uses it to shut down EDR processes. This is called Bring Your Own Vulnerable Driver (BYOVD), a method many groups are now abusing trusted Windows drivers to use.
If it lacks admin rights, it bypasses the UAC prompt and adds a Run key named “putty” so it survives a reboot. The final step is a custom form of Process Ghosting. The malware writes the payload to a temporary file, marks the file for deletion, and maps it into memory.
It then starts a legitimate process and points it at the payload. Windows deletes the file, so scanners find nothing to check. Cruciferra also patches memory-query hooks and weakens the NtManageHotPatch function, which would otherwise help check the loaded image.
Campaigns and Payloads
Proofpoint has seen dozens of campaigns from several unrelated groups. Targeting is opportunistic, with message volumes from a few hundred to thousands.
Financial, healthcare, and government groups appear most often. One actor, TA4922, sent tax-themed emails that posed as India’s Income Tax Department and led to fake portals hosting ZIP files. The result was AsyncRAT.
Other emails posed as the U.S. Social Security Administration and delivered XWorm, while guest-complaint lures aimed at hotels and travel firms led to zgRAT.
The payload list is long. It includes Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, XLoader, Phantom Stealer, Remcos, Snake Keylogger, ValleyRAT, XWorm, and zgRAT.
Other delivery routes exist too. eSentire saw Cruciferra delivered through ClickFix pages made by the ErrTraffic MaaS tool. In that case the loader used the DCRCVDrv.sys driver to end 145 antivirus and EDR-related processes, and it dropped the Remus stealer. eSentire also describes a $1,200 monthly package and a cheaper $650 option.
Defenders should block known vulnerable drivers and keep Microsoft’s vulnerable-driver protections on. Teams should also watch for unexpected driver services, DLL side-loading from archives, and a “putty” Run key.
PowerShell logging helps, and staff should be wary of unexpected tax or complaint emails. Because pasting commands from a web page is a common trick in fake CAPTCHA lure campaigns, users should never do it.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e | TA4922 Cruciferra / AsyncRAT, Tax-Number52563.zip |
| SHA-256 | 66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865 | TA4922 Cruciferra / AsyncRAT, Tax-Number809863.zip |
| SHA-256 | a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02 | TA4922 Cruciferra / AsyncRAT, Tax-Number119863.zip |
| SHA-256 | 59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347 | TA4922 Cruciferra / AsyncRAT, Tax-Number101863.zip |
| SHA-256 | 6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac | TA4922 Cruciferra / AsyncRAT, Tax-Number33863.zip |
| SHA-256 | 3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d | Cruciferra / zgRAT, photo295825092412.zip |
| SHA-256 | 0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce | Cruciferra DLL, mscoree.dll (eSentire) |
| SHA-256 | 2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a | GoFlyDrv.sys driver |
| SHA-256 | 17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4 | Core64.sys driver |
| URL | hxxp://hsahyteiows[.]gu[.]cc | AsyncRAT payload URL |
| URL | hxxp://fuaytrwese[.]love | AsyncRAT payload URL |
| URL | hxxp://jaiydteds[.]love | AsyncRAT payload URL |
| URL | hxxps://almacensantangel[.]com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152[.]rar | XWorm payload URL |
| URL | hxxps://digital-magicians[.]com/photo295825092412[.]zip?r=ea623202 | zgRAT payload URL |
| Domain | gatuso[.]duckdns[.]org | XWorm C2 |
| Domain | 0zbqnac1t4dv2t2wuodv1m[.]com | zgRAT C2 |
| IP:Port | 89[.]34[.]90[.]99:56001 | zgRAT C2 |
| Registry | SoftwareMicrosoftWindowsCurrentVersionRun = “putty” | Persistence |
Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs
