← Back to Feed
Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
July 27, 2026 · The Hacker News · Severity: HIGH
China-linked cybercrime groups are using a sophisticated crypter service called Cruciferra to deliver RATs and info-stealers. Written in Mono, Cruciferra employs BYOVD-based EDR tampering, indirect system calls, API/IAT unhooking, privilege escalation, persistence mechanisms, and Process Ghosting to execute payloads while minimizing forensic artifacts. Proofpoint observed it being used by multiple unrelated cybercriminal clusters to target Indian taxpayers and corporate finance teams via income tax-themed phishing lures.
Key Takeaways
- Cruciferra is a sophisticated Mono-based crypter used by China-linked groups to deliver RATs and info-stealers. Multiple unrelated cybercriminal threat clusters use Cruciferra, indicating it operates as a crypting service.
- Techniques include BYOVD-based EDR tampering, indirect syscalls, API unhooking, privilege escalation, and Process Ghosting. Process Ghosting and BYOVD techniques minimize forensic artifacts and evade detection by security products.
- Targets include Indian taxpayers, tax professionals, and corporate finance teams via income tax-themed phishing lures.