Cruciferra MaaS Enables Sophisticated Evasion for Infostealers and RATs
A potent malware-as-a-service (MaaS) known as Cruciferra is empowering cybercriminals with advanced evasion techniques to deploy infostealers and remote access trojans, with ESET blocking over 700,000 compromise attempts since January 2026.
Cybercriminals are increasingly leveraging a sophisticated malware-as-a-service (MaaS) called Cruciferra to obscure the presence of infostealers and remote access trojans (RATs) from security software. This 'crypter' service encrypts malicious files, only decrypting them upon execution on a victim's machine, thereby significantly hindering detection by antivirus and endpoint detection tools. Active since the fall of 2025, Cruciferra is a rebrand of the established KGB cryptor, indicating experienced operators behind the service. Proofpoint reports that the monthly subscription fees for Cruciferra range from $450 to $2,000, depending on the feature set, making it accessible to a wide range of threat actors.
ESET Research has observed a substantial increase in activity, blocking over 700,000 compromise attempts linked to Cruciferra since January 2026. The most heavily impacted regions include Türkiye, Greece, and Spain. The crypter's effectiveness stems from its extensive payload protection, featuring over 90 distinct encryption routines, many derived from well-known algorithms. This variety ensures that each batch of malicious samples appears unique, effectively circumventing signature-based detection methods. Researchers also note that Cruciferra appears to function as an umbrella term for multiple crypters offered within a single package.
Infection vectors typically involve phishing emails, malicious links within archives, or deceptive lures like fake tax pages. Once initiated, the process often starts with a ZIP file containing an executable and a Dynamic Link Library (DLL). Cruciferra consistently employs DLL side-loading, where a seemingly legitimate executable quietly loads a malicious DLL. Before proceeding, the malware performs checks to detect sandboxed environments or virtual machines used by security analysts. To further impede analysis, the DLL is packed with thousands of fake exported functions, designed to slow down reverse engineering efforts.
Cruciferra actively targets the defenses present on the compromised machine. It systematically removes monitoring hooks established by security tools within Windows functions, conceals console windows, and disables Windows notification pop-ups. A critical component of its evasion strategy involves the use of a signed but vulnerable driver, such as GoFlyDrv.sys, to terminate security processes. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), is a growing trend among threat actors seeking to disable endpoint security solutions.
If the malware lacks administrative privileges, it bypasses User Account Control (UAC) prompts and establishes a persistence mechanism by adding a Run key named 'putty'. This ensures the malware can survive system reboots. The final stage of execution utilizes a custom form of Process Ghosting. The malware writes its payload to a temporary file, marks it for deletion, and then maps it into memory. It then initiates a legitimate process and directs it to the payload. As the temporary file is deleted, security scanners are left with no physical file to analyze, further complicating detection.
Proofpoint has documented numerous campaigns utilizing Cruciferra, attributed to various independent threat groups. The targeting is largely opportunistic, with attack volumes ranging from hundreds to thousands of messages. Common targets include financial, healthcare, and government organizations. One notable actor, TA4922, has employed tax-themed phishing emails, impersonating tax authorities to direct victims to fake portals that host malicious ZIP files, ultimately delivering payloads like AsyncRAT.
The range of payloads delivered via Cruciferra is extensive, including Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, XLoader, Phantom Stealer, Remcos, Snake Keylogger, ValleyRAT, XWorm, and zgRAT. Other delivery methods have also been observed; eSentire reported Cruciferra being distributed through ClickFix pages generated by the ErrTraffic MaaS tool, leading to the deployment of the Remus stealer. Defenders are advised to block known vulnerable drivers, maintain Microsoft's vulnerable-driver protections, and monitor for unusual driver services, DLL side-loading from archives, and specific persistence keys like 'putty'.