The China-linked cybercrime group known for targeting Indian taxpayers with income tax-related phishing lures has been observed leveraging a highly sophisticated crypter service named **Cruciferra**. According to **Proofpoint**, **Cruciferra** is being utilized by a diverse array of unrelated cybercriminal threat clusters to distribute numerous Remote Access Trojans (RATs) and information stealer malware. ### Unpacking Cruciferra's Evasion Techniques **Proofpoint**'s analysis, published last week, highlights **Cruciferra**'s advanced evasion capabilities. The crypter, written in **Mono**, incorporates various techniques to bypass detection, analysis, and incident response efforts. These techniques include indirect system calls, API and Import Address Table (IAT) unhooking, and bring-your-own-vulnerable-driver (**BYOVD**)-based Endpoint Detection and Response (EDR) tampering. It also employs privilege escalation, persistence mechanisms, and a customized implementation of **Process Ghosting** to execute payloads while minimizing forensic artifacts. Crypters are crucial in the cybercriminal ecosystem, enabling threat actors to obfuscate their payloads, avoid detection, and enhance malware delivery success rates. ### Polymorphic Encryption and Underground Sales **Cruciferra** emphasizes payload protection through various custom encryption routines. These routines appear to be dynamically derived and assembled from established cryptographic algorithms, leading to variations between samples and complicating static analysis and signature-based detections. Researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci noted, "The algorithm used to encrypt payloads and strings in each set of samples is different, and there is such a large variance of these algorithms, which means it is probably randomly generated (polymorphically) from elements of well-known hashing, PRNG, and cipher algorithms." **Cruciferra** has been advertised on the cybercrime underground as the "most lethal crypter," with prices ranging from $450 to $2,000 per month. It first became available for sale in the fall of 2025. Malware families distributed via **Cruciferra** include **Agent Tesla**, **AsyncRAT**, **DarkCloud Stealer**, **Formbook**, **Phantom Stealer**, **Remcos RAT**, **Snake Keylogger**, **ValleyRAT**, **XLoader**, **XWorm**, and **zgRAT**. ### Campaign Vectors and Targeted Sectors Campaigns leveraging **Cruciferra** primarily use phishing as the initial access vector. The tool offers flexibility, allowing for either the direct dropping of an encrypted payload to disk or its download from a staging server. The observed activity is opportunistic, with campaigns reaching hundreds to thousands of messages. Primary targets span financial services, healthcare, government, education, and manufacturing sectors. One notable campaign has been attributed to the Chinese-speaking cybercrime actor **TA4922**, which shares some overlap with another prolific group, **Silver Fox**. This group employs tax-themed lures to direct victims to attacker-controlled landing pages hosting ZIP files that deliver malware. Four such campaigns were identified between April and early June 2026. This activity was previously documented by **Seqrite Labs** and **Cyderes Howler Cell**, with **Seqrite Labs** tracking it as **Operation DragonReturn**. Other campaigns observed using **Cruciferra** include: * Emails impersonating the U.S. Social Security Administration (**SSA**) to deliver **XWorm** and **AdaptixC2** (May 2026). * Emails using themes related to bed bugs and guest complaints to target hospitality and travel organizations, delivering **zgRAT** (late June 2026). ### Advanced Evasion and Persistence Regardless of the specific campaign, **Cruciferra** is consistently executed via **DLL side-loading**, employing advanced evasion and anti-analysis techniques. These include hiding console windows, unhooking Windows API functions to reduce visibility, using indirect system calls, disabling user notifications, and abusing the "GoFlyDrv.sys" driver in a **BYOVD** attack to terminate security processes. **Proofpoint** elaborates: "**Cruciferra** checks if it is running with Administrator privileges, and if not, attempts to elevate its privileges by bypassing **UAC** using the **COM Elevation Moniker**. Additionally, **Cruciferra** establishes persistence by writing to the registry `Software\Microsoft\Windows\CurrentVersion\Run` key with a default value of 'putty.' This ensures **Cruciferra** runs after system reboot." The final payload is loaded into memory using a variant of **Process Ghosting**. This advanced malware evasion technique on Windows executes malicious code from a temporary file that is deleted from the disk before the process starts, effectively blinding security products as there is no "file" to scan. **Cruciferra** further enhances its sophistication by patching **ZwQueryVirtualMemory** hooks and attempting to tamper with the **NtManageHotPatch** routine to conceal file deletion and neutralize integrity checks. **Proofpoint** concludes that while crypters have long been used to evade detection, "**Cruciferra** distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection."