# Crimeware-as-a-Service: Inside the Malware Crypting Services Market and Its Threat Actors

> Recorded Future's Insikt Group profiled 24 active malware crypting/FUD-loader services (VIP Crypt, ASMCrypt, GoldenCrypt, HijackLoader/IDAT Loader, TOP RAT/SnappyClient) operating on underground forums, dark-web platforms, and Telegram, which bundle AES-256/ChaCha20 encryption, in-memory decryption, polymorphic builds, process injection, and AMSI/ETW/EDR-bypass tradecraft to deploy Remcos RAT, Rhadamanthys, Netwire RAT, Agent Tesla, and PureRAT undetected. A May 2025 Ghost Crypt/PureRAT intrusion against a US accounting firm, documented by eSentire, illustrates the real-world impact of this commercial crypting supply chain.

- **Published:** 2026-08-13T00:00:00Z
- **Last reviewed:** 2026-08-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2008
- **ID:** TL-2026-2008
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** ImComplexed
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Insikt Group's report maps a professionalized "crimeware-as-a-service" ecosystem of 24 confirmed crypting/loader providers active within the past year, supplying commodity and professional threat actors with defense-evasion capability as a subscription or one-time-purchase service ($29-$20,000+ depending on tier). Named providers include mrlapis (VIP Crypt, active since 2011, ~$83,000 in documented proceeds; contactable via Telegram @mrlapis_real, Tox, and Jabber; infrastructure includes an Air VPN exit IP in Latvia and two FTPS servers), ImComplexed (active since July 2020, ~$166,878 in proceeds, Hyper-V Manager-themed masquerading loader), and o1oo1/Araks (ASMCrypt and TOP RAT/SnappyClient, ~$3.6 million in proceeds over five years).

The services converge on a common technical playbook: AES-256 or modified-ChaCha20 payload encryption, GZIP compression and string/junk-code obfuscation for polymorphism, staged in-memory decryption and manual PE mapping, and process-injection primitives (DLL injection, process hollowing, APC injection, process doppelganging, CLR/.NET reflective loading) combined with AMSI bypass, ETW patching, direct-syscall unhooking, and explicit bypass claims against Microsoft Defender, SmartScreen, CrowdStrike Falcon, and SentinelOne.

A concrete case study ties this market to real intrusions: in May 2025 an attacker impersonating a prospective client used a phishing PDF linking to a Zoho WorkDrive-hosted ZIP archive to deliver a double-extension executable (.pdf.exe) against a US certified public accounting firm. The payload abused the legitimate Haihaisoft hpreader.exe binary to side-load a malicious DLL (oledlg.dll, deployed as CriticalUpdater0549303.dll), which used the newly advertised "Ghost Crypt" crypter's "Process Hypnosis" technique — DEBUG_ONLY_THIS_PROCESS process creation, VirtualAllocEx/WriteProcessMemory injection, ZwManageHotpatch patching to bypass Windows 11 24H2+ protections, and SetThreadContext-based execution redirection — to inject the PureRAT trojan into csc.exe. PureRAT then persisted via a Registry Run key, enumerated cryptocurrency-wallet browser extensions and desktop wallets (Ledger Live, Exodus, Atomic Wallet), and communicated over an X.509-certificate-encrypted C2 channel. Separately, HijackLoader (aka IDAT Loader, aka GhostPulse) — a builder used by several of the profiled crypting services — has independently been documented by CrowdStrike using Heaven's Gate hook bypass, interactive/pipe-triggered process hollowing, and transacted-section process doppelganging to deploy follow-on tooling such as Cobalt Strike beacons.

## MITRE ATT&CK

- T1587.001 Malware
- T1608.001 Upload Malware
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1546.003 Windows Management Instrumentation Event Subscription
- T1574.001 DLL
- T1055.012 Process Hollowing
- T1055.004 Asynchronous Procedure Call
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1055.013 Process Doppelgänging
- T1620 Reflective Code Loading
- T1518 Software Discovery
- T1005 Data from Local System
- T1573.002 Asymmetric Cryptography
- T1657 Financial Theft

## Sources

- [Crimeware-as-a-Service: Inside the Malware Crypting Services Market and Its Threat Actors](https://www.recordedfuture.com/research/malware-crypting-services-threat-actors)
- [Ghost Crypt Powers PureRAT with Hypnosis](https://www.esentire.com/blog/ghost-crypt-powers-purerat-with-hypnosis)
- [PureRAT IOCs (27-06-2025)](https://github.com/eSentire/iocs/blob/main/PureRAT/PureRAT_IOCs_27-06-2025.txt)
- [HijackLoader Expands Techniques to Improve Defense Evasion](https://www.crowdstrike.com/en-us/blog/hijackloader-expands-techniques/)
- [Accounting Firm Targeted by Malware Campaign Using New Crypter](https://www.infosecurity-magazine.com/news/crypter-malware-targets-accounting/)
- [Ghost Crypt Delivers PureRAT in Accounting Firm Attack](https://hivepro.com/threat-advisory/ghost-crypt-delivers-purerat-in-accounting-firm-attack/)
- [Novel crypter tapped to spread PureRAT trojan](https://www.scworld.com/brief/novel-crypter-tapped-to-spread-purerat-trojan)
- [HijackLoader Evolves: Researchers Decode the Latest Evasion Methods](https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html)
- [HijackLoader Expands Techniques to Improve Defense Evasion](https://cloudsecurityalliance.org/blog/2024/03/08/hijackloader-expands-techniques-to-improve-defense-evasion)
- [HijackLoader/GhostPulse/IDAT Loader Comprehensive Analysis](https://medium.com/@baglai.vlad/hijackloader-ghostpulse-idat-loader-comprehensive-analysis-6e15f48eb96d)
- [HijackLoader — Red Canary Threat Detection Report](https://redcanary.com/threat-detection-report/threats/hijackloader/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2008