Hackers are abusing the Cruciferra crypter-as-a-service to systematically turn off endpoint detection and response (EDR) tools and stealthily deploy XWorm, Remcos, AsyncRAT, and other commodity malware in email-driven campaigns targeting multiple sectors worldwide.
By combining BYOVD-based driver abuse, indirect syscalls and a polymorphic encryption engine with more than 90 mix-and-match crypto routines, Cruciferra has rapidly become a high-value enabler in the malware-as-a-service ecosystem.
Multiple unrelated cybercrime clusters are leveraging the service to conceal remote access trojans (RATs) and infostealers, including AsyncRAT, XWorm, Remcos, Agent Tesla, Formbook/XLoader, Phantom Stealer, ValleyRAT and Snake Keylogger.
The crypter is written in Mono and appears to operate as an “umbrella” platform bundling several related crypters. However, Proofpoint’s analysis focuses on the variant most frequently observed in the wild.
Active development is evident from both production and “test” builds, with frequent new samples uploaded to malware repositories and debug timestamps showing fresh Cruciferra-packed binaries generated every few minutes on some days.
Cruciferra currently underpins dozens of email-based campaigns, where threat actors deliver ZIP or VHD containers that pair a seemingly benign executable with a malicious DLL.
When the victim launches the executable, the DLL is side-loaded and invokes Cruciferra, which then handles environment checks, payload decryption, EDR tampering and final malware execution.
Observed campaigns span multiple verticals, including financial services, healthcare and government, with opportunistic targeting and message volumes ranging from hundreds to thousands per run.
Payload delivery is flexible: Cruciferra can drop the decrypted RAT or stealer to disk, load it from an auxiliary file within the initial archive, or download it from a staging server, depending on the actor’s configuration.
Proofpoint researchers track Cruciferra as a sophisticated crypter service sold on the Exploit[.]in underground forum since autumn 2025, with subscription tiers reportedly ranging from 450 to 2,000 USD per month depending on feature set.
Between late April and early June 2026, Chinese-speaking crime actor TA4922 ran at least four Cruciferra-backed campaigns ultimately delivering AsyncRAT.
The group used tax-themed lures impersonating “Income Tax Department” or “Government of India” notices, leading victims to fake government portals hosting ZIP files that contained the side-loading executable/DLL pair which initiates the Cruciferra infection chain.
The phishing pages closely mimicked legitimate tax portals and relied on embedded URLs in emails or PDFs to drive clicks, reinforcing urgency and legitimacy while maintaining a consistent social engineering pattern.
Once executed, Cruciferra ensured the environment was safe for payload execution before dropping AsyncRAT, giving TA4922 persistent remote access for data theft and follow-on actions.
Cruciferra has also been linked to campaigns abusing U.S. Social Security Administration (SSA)-themed lures to deliver XWorm and AdaptixC2, echoing earlier multi-stage attacks where XWorm and Remcos were deployed via Rust-based injectors like Freeze.rs.
In these Cruciferra-backed operations, victims receive SSA-branded emails referencing tax documents and deadlines, with embedded URLs directing them to download VHD images.
When opened, the VHD executes a chain that launches Cruciferra, which then decrypts and executes XWorm, providing attackers with a full-featured RAT capable of keylogging, credential theft, lateral movement and remote command execution.
Similar toolchains have been documented in prior campaigns where LNK files and PowerShell loaders culminated in Rust injectors that deployed both XWorm and Remcos, highlighting a broader trend of combining crypters and injectors to outmaneuver EDR solutions.
In late June, another Cruciferra campaign targeted hospitality and travel organizations using “guest complaint” and bed bug–themed emails.
The messages contained URLs disguised as links to photographic evidence, but instead delivered a ZIP archive containing a malicious LNK that launched a PowerShell command to execute a staged PowerShell script.
This script first fingerprinted the victim system and beaconed the information to attacker-controlled infrastructure before downloading a ZIP that ultimately installed Cruciferra, which in this case was observed loading zgRAT.
The multi-stage design allowed actors to gate payload delivery based on system profiling, while Cruciferra’s defense-evasion stack minimized the chance that EDR or analysts could observe the final RAT deployment.
Cruciferra’s core value lies in its layered defense evasion, combining user-mode and kernel-mode techniques to blind security tooling before any RAT or stealer executes.
The crypter aggressively unhooks Windows APIs, repairs the Import Address Table (IAT), and uses indirect syscalls sourced from a clean copy of ntdll.dll to bypass inline hooks often used by EDRs and sandboxes to monitor behavior.
To neutralize EDR at the kernel level, Cruciferra deploys a Bring-Your-Own-Vulnerable-Driver (BYOVD) approach, frequently abusing drivers such as GoFlyDrv.sys and other known-vulnerable kernel modules to issue IOCTL commands that enumerate and terminate security processes.
The final payload is then executed via a modified Process Ghosting routine: Cruciferra writes the malware into a temporary, soon-to-be-deleted file used to back an image section, then maps that section into a suspended process and patches ZwQueryVirtualMemory and NtManageHotPatch so that EDR memory scanners receive sanitized results.
To protect embedded payloads, Cruciferra stores them in the PE’s .reloc section and encrypts them using one of more than 90 custom cryptographic routines assembled from components of algorithms such as Keccak, Threefish-derived constructions, Feistel variants, ARX-based designs and DES-CBC.
Each build tends to use a distinct, polymorphically generated routine, making static analysis and signature creation significantly more difficult for defenders.
Researchers have also noted that Cruciferra-packed binaries often include pseudo-randomized PE metadata such as copyright, product and description strings composed of date-stamped nonsense phrases which, combined with Yara signatures and upload patterns, provide telemetry for tracking the service’s ongoing operations.
These indicators, along with the observed use of Cruciferra to deploy XWorm, Remcos, AsyncRAT and other toolkits, underscore the crypter’s central role as a shared infrastructure component across disparate crimeware ecosystems.
| IOC | Description | First Seen |
| hxxp://hsahyteiows[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 28 April 2026 |
| hxxp://yicoweytcbtw[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 28 April 2026 |
| hxxp://nciyeyrawoe[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 28 April 2026 |
| hxxp://lasiduutfe[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 28 April 2026 |
| 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e | TA4922 Cruciferra / AsyncRAT SHA256 Tax-Number52563.zip | 28 April 2026 |
| hxxp://xkcifgieusr[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://viuyeyrwqs[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://pmcjsuyraw[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://laiwutrencr[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://maisytawe[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://kawosyetw[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://nviuawusye[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://faeytrdeaw[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://figyuyrqwr[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
| hxxp://hfyuayustrv[.]gu[.]cc | TA4922 Cruciferra / AsyncRAT Payload URL | 4 May 2026 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…