CRUCIFERRA crypter identified by Proofpoint as a service used by the Chinese‑speaking group TA4922 to pack malware.
It primarily delivers remote access trojans and infostealers via email campaigns that rely on DLL side‑loading from executable files.
The crypter uses a custom encryption engine that cycles through more than ninety distinct cipher routines, allowing each payload to be repacked with a unique key.
It also combines process ghosting techniques with the abuse of a vulnerable kernel driver to bring its own vulnerable driver (BYOVD) into play, thereby bypassing many signature‑based defences.
Bundled payloads include AsyncRAT and XWorm and the service is offered on a tiered subscription model ranging from four hundred fifty to two thousand dollars per month, as noted by securityonline.info.
Distribution hinges on DLL side‑loading, where a legitimate‑looking executable loads a malicious dynamic link library that decodes and runs the encrypted payload in memory.
Proofpoint observed activity linked to TA4922 between 20 July and 27 July 2026, with campaigns that used decoy documents and fake invoices to lure victims.
The group’s reliance on the crypter has allowed it to evade detection across financial, health and government sectors.
Defenders should prioritise behavioural monitoring over static signatures, watching for abnormal DLL loading attempts and efforts to load unsigned or outdated kernel drivers.
Enforcing driver signing policies, restricting execution from temporary folders and enabling memory‑based inspection can help spot the crypter’s evasion tricks before they achieve persistence.
Regularly updating endpoint detection and response rules to flag process ghosting indicators and unusual encryption routines adds another layer of protection.
Sharing indicators of compromise within trusted information‑sharing groups improves the odds of catching fresh variants of the Crypter.