Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

A China-linked cybercrime group has been using a crypter service called Cruciferra to hide Windows malware. The group has been targeting Indian taxpayers, tax professionals, and corporate finance teams with income tax-related phishing lures. Cruciferra has also been used by other unrelated cybercriminal threat clusters to deliver various remote access tools. The crypter service utilizes techniques such as BYOVD and process ghosting to evade detection. According to Proofpoint's analysis, Cruciferra is a sophisticated tool used to deliver a wide range of malware. Its use suggests that various cybercriminal groups are leveraging advanced tools to carry out their operations.