The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra.
According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote access trojans (RATs) and information stealer malware.
“Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts,” the enterprise security company said in an analysis published last week.
“These include using indirect system calls, API and Import Address Table (IAT) unhooking, bring-your-own-vulnerable-driver (BYOVD)-based EDR tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting used to execute payloads while minimizing forensic artifacts.”
Crypters (also spelled cryptors) play an important role in the cybercriminal ecosystem as they allow bad actors to obfuscate their payloads, avoid detection, and improve malware delivery success rates.
An emphasis on payload protection notwithstanding, Cruciferra supports various custom encryption routines that appear to be dynamically derived and assembled from established cryptographic algorithms, thereby introducing variations between samples and complicating static analysis as well as signature-based detections.
“The algorithm used to encrypt payloads and strings in each set of samples is different, and there is such a large variance of these algorithms, which means it is probably randomly generated (polymorphically) from elements of well-known hashing, PRNG, and cipher algorithms,” per researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci.
The service has been advertised on the cybercrime underground as the “most lethal crypter” for $450 to $2,000 a month. It was first made available for sale in fall 2025. Some of the commodity malware families distributed via Cruciferra include Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT.
Campaigns leveraging the crypter have leveraged phishing as the primary initial access vector, with the tool incorporating the flexibility to either drop an encrypted payload to disk or download it from a staging server. The activity is assessed to be opportunistic, reaching anywhere between hundreds and thousands of messages per campaign. The primary targets include financial services, healthcare, government, education, and manufacturing sectors.
One such campaign has been attributed to Chinese-speaking cybercrime actor TA4922, which shares some level of overlap with another prolific threat group called Silver Fox. This involves employing tax-themed lures to drive victims to attacker-controlled landing pages hosting ZIP files to deliver malware. Four such campaigns have been identified between April and early June 2026.
It’s worth mentioning here that this attack was documented in detail earlier this month by Seqrite Labs and Cyderes Howler Cell. Seqrite Labs is tracking the activity under the moniker Operation DragonReturn.
Other campaigns that have been observed using Cruciferra are below –
- Emails impersonating the U.S. Social Security Administration (SSA) to deliver XWorm and AdaptixC2 (May 2026)
- Email using themes related to bed bugs and guest complaints to target organizations in the hospitality and travel industries and deliver zgRAT (late June 2026)
Regardless of the campaign, Cruciferra is always executed via DLL side-loading, while leveraging evasion and anti-analysis techniques to fly under the radar. This includes hiding console windows, unhooking Windows API functions to reduce visibility, indirect system calls, disabling user notifications, and the abuse of the “GoFlyDrv.sys” driver as part of a BYOVD attack to terminate security processes.
“Cruciferra checks if it is running with Administrator privileges, and if not, attempts to elevate its privileges by bypassing UAC using the COM Elevation Moniker,” Proofpoint explained. “Additionally, Cruciferra establishes persistence by writing to the registry Software\Microsoft\Windows\CurrentVersion\Run key with a default value of ‘putty.’ This ensures Cruciferra runs after system reboot.”
The final payload is loaded into memory using a variant of Process Ghosting, which, at a high level, refers to an advanced malware evasion technique on Windows where malicious code is executed from a temporary file that is deleted from the disk before the process starts. This, in turn, blinds security products as there is no “file” to scan.
Cruciferra adds an extra layer of sophistication by patching ZwQueryVirtualMemory hooks and by attempting to tamper with the NtManageHotPatch routine to hide the deletion of the file and neutralize integrity checks.
“While crypters have long been used to evade detection and increase malware delivery and execution success rates, Cruciferra distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection,” Proofpoint concluded.
