Cruciferra Service Offers Subscription-Based EDR Evasion and Fileless Malware Execution
A new subscription-based crypter service, Cruciferra, is enabling threat actors to bypass Endpoint Detection and Response (EDR) defenses and execute malware without leaving disk artifacts.
A sophisticated criminal service known as Cruciferra is providing malware operators with advanced capabilities to evade Windows security defenses. Marketed on underground forums for up to $2,000 per month, this subscription-based crypter wraps malicious programs, making them significantly harder for security tools to inspect, block, and trace. Active since the fall of 2025, Cruciferra has been observed in numerous campaigns targeting organizations across the financial, healthcare, government, travel, and hospitality sectors. Threat actors are employing various social engineering tactics, including email lures, fake tax portals, malicious PDF links, ZIP archives, and virtual hard disk files, to distribute the initial infection vector.
Proofpoint researchers have identified Cruciferra in dozens of campaigns, noting that its primary danger lies not in a single payload, but in the service's ability to conceal diverse malware families. By constantly altering its code, Cruciferra undermines signature-based detection methods and facilitates the widespread distribution of malware. Buyers can deploy various remote-access trojans (RATs) and information stealers, such as AsyncRAT, XWorm, zgRAT, Agent Tesla, Formbook, Remcos, and XLoader, making it a versatile tool for cybercriminals.
The Cruciferra service is developed using Mono and leverages DLL side-loading techniques for execution. When a victim launches a compromised executable, Windows inadvertently loads a malicious DLL, initiating the crypter. This method is a common tactic, reinforcing the need for vigilance when handling unexpected archives. Before deploying its payload, Cruciferra performs checks to detect if it is running within a sandbox or a virtual machine environment, a standard evasion technique to avoid analysis.
Cruciferra employs several advanced techniques to evade detection. It pads its DLLs with harmless exported functions, conceals its console window, and actively removes monitoring hooks from critical Windows functions that are frequently used by EDR products. One of its most potent features is the ability to perform a Bring Your Own Vulnerable Driver (BYOVD) attack. Cruciferra can deploy a signed, yet vulnerable, driver and then issue low-level commands to terminate security processes, effectively disabling endpoint protection before delivering its malicious payload.
Further enhancing its stealth, Cruciferra seeks administrator privileges, modifies registry settings to suppress Windows notifications, and establishes persistence to survive reboots. It utilizes indirect system calls and Import Address Table (IAT) repair to minimize its visibility within the system. These techniques align with a broader trend of attackers increasingly abusing EDR evasion frameworks to operate undetected.
The payload protection offered by Cruciferra is designed for maximum variability. Proofpoint observed over 90 distinct encryption routines, many of which are assembled from components of known algorithms rather than being used in their standard form. This ensures that each build can appear unique to security scanners, even if the underlying malware performs the same function.
For the final execution stage, Cruciferra employs a customized form of Process Ghosting. This technique involves writing the malware payload to a temporary file, immediately marking it for deletion, mapping it into memory, and then allowing the operating system to remove the disk artifact. The malicious program then hijacks a suspended legitimate process, redirects it to the in-memory payload, and resumes its execution. This process allows the malware to run without ever existing on disk in a conventionally scannable form. Cruciferra also attempts to disguise the deleted backing file when EDR tools scan memory and interferes with Windows functions that validate loaded images.
Campaigns utilizing Cruciferra have been observed using deceptive themes, such as impersonating tax authorities or social security agencies, to trick users into downloading malicious ZIP files. Other lures have included guest complaint or bed-bug themes, often delivered via shortcut files that initiate PowerShell commands to start the infection chain. Security professionals recommend blocking vulnerable drivers, maintaining up-to-date software, enabling PowerShell logging, and exercising extreme caution with unexpected download requests, especially those with urgent or alarming themes.