Cruciferra Crypter’s BYOVD & Process Ghosting Lets Malware Slip Past EDR
Proofpoint’s latest analysis reveals Cruciferra, a Mono‑based crypter‑as‑a‑service sold since late 2025 that now powers RATs and infostealers for dozens of unrelated threat groups. It cloaks payloads with indirect system calls, API/IAT unhooking, BYOVD driver abuse and a custom process‑ghosting routine, plus over 90 dynamically assembled encryption variants, rendering static signatures and most EDR sensors ineffective.