The more difficult the malicious program is to see on disk and in memory, the longer it can go unnoticed, and the criminal service Cruciferra combined several ways of hiding in one tool. According to Proofpoint, different hackers use it in dozens of campaigns with AsyncrAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.
Cruciferra is sold on the Exploit forum since the autumn of 2025. The service packs ready-made malware so that it is more difficult for security systems to recognize their code and stop the launch. Proofpoint specialists found both working samples from real attacks and files that were allegedly used to test new features.
The attack began with the ZIP archive, where there was a legitimate program and a malicious DLL library. After launch, the program quietly picked up the neighboring library. She checked the environment, hid real logic among hundreds of empty functions and prepared the main load.
Before launching the malware, Cruciferra turned off several levels of surveillance from the defenses. In particular, the service downloaded a vulnerable signed GoFlyDrv.sys driver and through it completed security processes. This technique is called BYOVDBYOVD: attackers bring to the system a legal, but vulnerable driver and use his rights to circumvent the protection.
The payload was stored inside the service partition of the file and was decrypted by one of more than 90 combined schemes. Cruciferra collected them from parts of Keccak, Threefish and the Feistel family, so different samples rarely looked the same.
For the final launch, the service used a modified Process Ghosting. Cruciferra created a temporary file with malicious code, ran it the process, and then deleted the file. The process continued to work in memory, although there was no longer any available to check the file on the disk. Additional changes forced security systems to obtain purified memory information and prevented you from checking the running image with the original file.
One series of attacks Proofpoint associated with the Chinese-speaking group TA4922. From the end of April to the beginning of June, the attackers sent baits on behalf of the Internal Regimen of India and delivered AsyncRAT. Other campaigns simulated notifications from the U.S. Social Welfare Administration or guest complaints about hotel bedbugs.
Most often, among the targets noticed, financial institutions, medical institutions and state structures met. On July 9, new samples packed by Cruciferra appeared on VirusTotal every few minutes.
Cruciferra is sold on the Exploit forum since the autumn of 2025. The service packs ready-made malware so that it is more difficult for security systems to recognize their code and stop the launch. Proofpoint specialists found both working samples from real attacks and files that were allegedly used to test new features.
The attack began with the ZIP archive, where there was a legitimate program and a malicious DLL library. After launch, the program quietly picked up the neighboring library. She checked the environment, hid real logic among hundreds of empty functions and prepared the main load.
Before launching the malware, Cruciferra turned off several levels of surveillance from the defenses. In particular, the service downloaded a vulnerable signed GoFlyDrv.sys driver and through it completed security processes. This technique is called BYOVDBYOVD: attackers bring to the system a legal, but vulnerable driver and use his rights to circumvent the protection.
The payload was stored inside the service partition of the file and was decrypted by one of more than 90 combined schemes. Cruciferra collected them from parts of Keccak, Threefish and the Feistel family, so different samples rarely looked the same.
For the final launch, the service used a modified Process Ghosting. Cruciferra created a temporary file with malicious code, ran it the process, and then deleted the file. The process continued to work in memory, although there was no longer any available to check the file on the disk. Additional changes forced security systems to obtain purified memory information and prevented you from checking the running image with the original file.
One series of attacks Proofpoint associated with the Chinese-speaking group TA4922. From the end of April to the beginning of June, the attackers sent baits on behalf of the Internal Regimen of India and delivered AsyncRAT. Other campaigns simulated notifications from the U.S. Social Welfare Administration or guest complaints about hotel bedbugs.
Most often, among the targets noticed, financial institutions, medical institutions and state structures met. On July 9, new samples packed by Cruciferra appeared on VirusTotal every few minutes.
