Cybercrime is outsourcing malware evasion
Modern phishing campaigns are no longer limited by social engineering. Criminal operators increasingly rely on specialized services that maximize malware survivability against security products. One of the latest examples is Cruciferra, a crypter service associated with Chinese threat actors that protects RATs and information stealers against modern EDR platforms.
According to Proofpoint's technical analysis, Cruciferra packages multiple advanced evasion techniques into a commercial service available on underground forums, allowing unrelated threat groups to deploy sophisticated malware with minimal technical effort.
What is a crypter?
A crypter modifies and protects malware before deployment. Rather than changing the malware's capabilities, it alters how the payload appears and behaves during execution, reducing detection by antivirus engines, EDRs, sandboxes and signature-based technologies.
Cruciferra goes beyond simple executable encryption by embedding multiple runtime evasion techniques.
Cybercrime as a subscription service
Sold through underground marketplaces since 2025, Cruciferra is offered as a monthly subscription ranging from US$450 to US$2,000, lowering the technical barrier for phishing operators.
Common infection vectors
Observed campaigns primarily rely on phishing emails impersonating tax authorities, government agencies and financial communications. Once the victim executes the attachment, the crypter activates its defensive evasion mechanisms.
Core evasion techniques
BYOVD
Legitimate vulnerable drivers are abused to interact with the Windows kernel and interfere with endpoint security solutions.
Process Ghosting
A modified implementation executes payloads directly in memory while minimizing forensic artifacts.
API Unhooking
The crypter restores monitored Windows APIs and performs indirect system calls to reduce EDR visibility.
Custom cryptography
More than ninety encryption routines allow unique payload generation, significantly reducing signature effectiveness.
DLL Sideloading
Legitimate applications are leveraged to load malicious libraries during execution.
Malware families
Observed payloads include Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm and zgRAT.
Security implications
The primary challenge is not the malware family itself but the combination of phishing, runtime evasion and techniques specifically designed to reduce the effectiveness of traditional detection controls.
Organizations relying exclusively on signature-based protection may leave important gaps undiscovered until a real compromise occurs.
Recommended defensive measures
- Deploy advanced email protection and attachment sandboxing.
- Monitor kernel activity and suspicious driver loading.
- Maintain operating systems and drivers fully patched.
- Adopt behavioral detection capabilities.
- Apply least-privilege principles.
- Implement network segmentation.
- Continuously train employees against phishing attacks.
Why Red Team assessments matter
Advanced evasion techniques such as BYOVD, Process Ghosting and DLL Sideloading are difficult to evaluate using automated scanners alone. Red Team engagements validate whether defensive controls can detect modern attack chains under realistic conditions.
At Antisec, Red Team, Penetration Testing and Purple Team engagements help organizations identify these gaps before they are exploited by real adversaries, providing actionable evidence to improve security posture.
