Cruciferra is a commercial crypter-as-a-service sold on cybercrime forums since fall 2025, offering EDR bypass capabilities to a growing roster of threat groups through a combination of bring-your-own-vulnerable-driver exploitation, Process Ghosting, DLL side-loading, and indirect system calls. Research disclosed on July 27, 2026 identifies at least two confirmed customers — TA4922 and Silver Fox — and links the service to distribution of eleven malware families across targets in financial services, healthcare, government, education, and manufacturing.
Cruciferra’s BYOVD and Process Ghosting Techniques Against EDR
Cruciferra’s core defense evasion capability rests on two techniques applied in combination. The first is Bring-Your-Own-Vulnerable-Driver, in which Cruciferra loads a legitimate but vulnerable Windows kernel driver signed by a recognized vendor. By exploiting a known vulnerability in that driver from kernel mode, the crypter can disable or neutralize the EDR software running on the same machine. BYOVD attacks exploit the trust Windows places in signed drivers and, by operating at the kernel level, remove the primary detection mechanism before the actual payload executes — leaving no monitoring agent in position to observe what follows.
The second technique is a customized implementation of Process Ghosting. Process Ghosting creates a process backed by a file that is deleted or replaced before execution begins, meaning forensic tools examining process memory cannot easily link the running process to an on-disk artifact. This reduces the forensic evidence available for incident response and complicates memory-based detection.
Beyond these two primary techniques, Cruciferra applies DLL side-loading, indirect system calls, and Import Address Table unhooking. Indirect system calls avoid the user-mode hooks that many EDR products place on Windows API functions monitored for suspicious behavior. IAT unhooking removes those hooks if they are already in place, restoring original API calls and reducing the visibility that user-mode interception provides to detection tools.
TA4922 and Silver Fox as Confirmed Cruciferra Adopters
TA4922, a Chinese-speaking cybercriminal group, and Silver Fox are among the identified customers of the Cruciferra MaaS platform. The adoption of the same crypter service by multiple independent threat groups across different regions demonstrates that Cruciferra has achieved sufficient operational maturity to be trusted by established criminal operations — not only by less sophisticated actors experimenting with new tools.
Cruciferra’s operator markets the service as the “most lethal crypter” for evading security tools and prices subscriptions between $450 and $2,000 per month. The recurring subscription model means the service actively generates revenue from ongoing criminal use, supporting continued development of its evasion capabilities.
Eleven Malware Families Distributed Through Cruciferra’s MaaS Operation
The range of malware distributed through Cruciferra includes Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT. The breadth of this family list reflects the design of the MaaS model: Cruciferra provides the EDR bypass, delivery infrastructure, and encryption layer while client threat groups supply the final payloads suited to their specific operational objectives — credential theft, banking fraud, remote access, or data exfiltration.
For security teams investigating infections involving any of these malware families, the presence of Cruciferra in the delivery chain means the endpoint’s EDR may have been neutralized before the payload landed, altering the forensic picture. Log gaps, missing process creation events, or EDR service disruptions preceding a malware detection should be treated as potential indicators of a BYOVD-stage attack.
What Makes Cruciferra’s Polymorphic Encryption Resistant to Signatures
Cruciferra applies polymorphic and dynamic encryption routines derived from established cryptographic algorithms. Each output sample varies in a designed manner that defeats signature-based detection: the same underlying payload wrapped by Cruciferra can produce different binary representations across separate deployments. Signature matching, hash comparison, and static file analysis cannot reliably detect Cruciferra-wrapped payloads when the crypter produces a different output signature for each delivery.
For defenders, the combination of BYOVD kernel exploitation, Process Ghosting, polymorphic encryption, and API hook removal means relying on any single detection layer — file-based, behavioral, or memory-based — will not catch all Cruciferra-wrapped attacks. Detection strategies that focus on kernel driver load events, identification of known vulnerable drivers entering a running system, and anomalous driver activity provide the most reliable signals for identifying BYOVD-stage attacks before the EDR neutralization step completes. Monitoring for the introduction of unexpected signed drivers, particularly those associated with known BYOVD exploit chains, gives security teams the earliest available opportunity to interrupt a Cruciferra-staged attack chain before the payload delivery stage begins.
