Cruciferra Crypter Uses BYOVD and Process Ghosting to Evade Detection and Deliver Windows Malware

Severity
Medium

Detail

Cybersecurity researchers at Proofpoint have identified Cruciferra, a sophisticated crypter service used by multiple cybercriminal groups to deliver a variety of Remote Access Trojans (RATs) and information-stealing malware. Active since late 2025, Cruciferra has been observed in phishing campaigns targeting organizations across financial services, healthcare, government, education, manufacturing, hospitality, and travel sectors.

The crypter has also been linked to tax-themed phishing campaigns conducted by the China-linked threat actor TA4922, which shares similarities with the Silver Fox threat group. According to Proofpoint, Cruciferra incorporates multiple defense evasion techniques that significantly reduce the effectiveness of traditional detection and forensic analysis.

How?

The attack typically begins with phishing emails containing malicious attachments or links to attacker-controlled websites. Victims are tricked into downloading ZIP archives that ultimately execute Cruciferra through DLL side-loading using legitimate Windows applications.

Once executed, Cruciferra performs several anti-analysis and defense evasion techniques, including API and Import Address Table (IAT) unhooking, indirect system calls, hiding console windows, disabling user notifications, and bypassing User Account Control (UAC) through the COM Elevation Moniker to obtain administrator privileges.

To further evade security products, Cruciferra abuses the vulnerable GoFlyDrv.sys driver in a Bring Your Own Vulnerable Driver (BYOVD) attack to terminate Endpoint Detection and Response (EDR) security processes. It also establishes persistence by creating a registry entry under Software\Microsoft\Windows\CurrentVersion\Run using the value “putty”, allowing the malware to execute automatically after system reboot.

The crypter decrypts its protected payload using dynamically generated encryption routines that vary between samples, making static analysis and signature-based detection more difficult. Finally, the payload is executed using a customized implementation of Process Ghosting, where the malicious executable is deleted from disk before execution, leaving minimal forensic evidence. Cruciferra further enhances this technique by patching ZwQueryVirtualMemory hooks and tampering with NtManageHotPatch routines to conceal the deleted file and bypass integrity checks.

Impact

Cruciferra has been used to distribute numerous malware families, including Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT.

The service is commercially available on underground cybercrime forums and supports both locally dropped and remotely downloaded payloads, allowing threat actors to customize their attacks. Its advanced defense evasion capabilities, polymorphic encryption, BYOVD-based EDR tampering, and Process Ghosting significantly reduce the effectiveness of traditional antivirus, hash-based detection, and forensic investigations.

Recommendation

Organizations should:

• Educate users to identify phishing emails, particularly those impersonating government agencies, tax authorities, or business-related communications.
• Block or restrict execution of unsigned DLLs and monitor for suspicious DLL side-loading activities.
• Enable attack surface reduction (ASR) rules and application control policies to prevent unauthorized executable and driver loading.
• Monitor for the installation or execution of vulnerable drivers, including GoFlyDrv.sys, as potential indicators of BYOVD attacks.
• Deploy Endpoint Detection and Response (EDR) solutions capable of detecting Process Ghosting, indirect system calls, registry persistence, and privilege escalation attempts.
• Regularly update security products and perform threat hunting using indicators of compromise (IOCs) published by Proofpoint.

Conclusion

Cruciferra represents an advanced malware delivery platform that combines multiple defense evasion techniques, including BYOVD attacks, DLL side-loading, polymorphic encryption, Process Ghosting, and privilege escalation to deliver malware while minimizing detection and forensic evidence. Its adoption by multiple cybercriminal groups across diverse phishing campaigns demonstrates the growing sophistication of malware delivery services and reinforces the importance of layered security controls, behavioral detection, and proactive threat hunting to defend against modern malware attacks.

Source

https://thehackernews.com/2026/07/cruciferra-crypter-uses-byovd-and.html