Cruciferra Crypter: BYOVD and Process Ghosting on the Market

Proofpoint published a new analysis of Cruciferra this weekend: a crypter service that bundles two evasion techniques — Bring Your Own Vulnerable Driver and Process Ghosting — into a package that multiple unrelated threat clusters are now using to deliver Windows malware. The China-linked group the researchers highlight was targeting Indian taxpayers with income-tax phishing lures, but that specific campaign is almost beside the point. The more important detail is that it was one of several distinct criminal groups using the same underlying service.

What the techniques actually do

BYOVD starts with something legitimate. The attacker drops a signed Windows kernel driver onto the target system — a driver with a known vulnerability, from a legitimate vendor, with a valid signature. Windows driver-signature enforcement passes it through. The attacker then exploits the driver’s bug from user space, gaining the ability to execute code at ring 0. This matters because endpoint security products — the ones watching for malicious behavior — often rely on kernel callbacks to monitor process creation, thread injection, and memory operations. An attacker operating below them, at the kernel level, can interfere with those callbacks before they fire. The evasion isn’t about hiding from a scan; it’s about neutralizing the sensor.

Process Ghosting works differently, and at a different layer. An attacker creates a section object — a Windows kernel structure that maps a file into memory — for a file on disk, marks that file for deletion, writes malicious code into the memory section, then launches a process from it. By the time the process is running and anything tries to examine the executable backing it, the file is already in a deletion-pending state. Forensic tools that try to open it get access denied or find nothing there. The process runs without a readable file on disk to scan, hash, or block.

Neither of these is new. Researchers have documented both individually over several years. What Proofpoint is tracking with Cruciferra is the packaging — someone has integrated both into a service that operators across multiple criminal clusters are now leasing without needing to understand the internals.

The pattern, not the campaign

The India tax-phishing campaign is a sensible case study. Income tax deadlines are a social engineering window; a phishing lure tied to an audit notice or refund status doesn’t require sophisticated targeting to convert. The actors involved were using Cruciferra to evade detection on the malware they delivered — the crypter handled the evasion, they handled the lure and distribution.

But Proofpoint found it being used by unrelated groups running different final payloads. That’s the pattern worth tracking. When BYOVD and Process Ghosting required kernel expertise to implement, the population of actors who could use them was bounded by who had that expertise. A service model removes the constraint. The capability diffuses across campaigns with different objectives, different targets, and different attribution fingerprints — all sharing infrastructure from the same provider.

This follows from what we’ve seen with RaaS operations like DevMan and the broader commoditization of offensive tooling over the past two years. The barrier to deploying sophisticated techniques keeps falling. The endpoint evasion bar has been roughly stable; the attacker skill floor keeps dropping.

For defenders, the implication is that detection built around any single campaign’s IOCs will miss the next group using the same crypter. The shared capability — the crypter service itself — is the more durable signal.

What to do

• Driver-load monitoring. Flag legitimate but vulnerable kernel drivers (especially those with public CVEs) loaded by unexpected parent processes, particularly at startup or shortly after user login. Cruciferra depends on loading a driver it chose, not one already on the system.
• EDR coverage for Process Ghosting. Detection varies significantly across products. If you don’t know whether your EDR catches section-based process launches from deletion-pending files, test it or ask your vendor. Now is a reasonable time to find out.
• Signature breadth. Signatures tuned to specific campaign IOCs miss shared-infrastructure campaigns entirely. Behavioral rules — unusual driver loads, process launches without a readable backing file — are more durable here.

For related East Asia threat actor tracking this week: TELESHIM’s Telegram-C2 campaign against Middle East governments, and separately, browser-based evasion patterns in the SourTrade malvertising campaign using in-memory malware assembly.

For broader coverage, see the Threat Intel & Field Notes hub.

Source: The Hacker News / Proofpoint, July 27, 2026