Threat reportMalwareTL-2026-5861
Cruciferra Crypter MaaS Used to Conceal Infostealers and RATs (AsyncRAT, XWorm, zgRAT, Remus and others)
Cruciferra is a Mono-based crypter-as-a-service sold on underground forums since fall 2025 ($450-$2,000/month) and used by multiple unrelated clusters, including TA4922, to deliver RATs and infostealers via phishing and ClickFix. It combines DLL side-loading, 90+ custom encryption routines, API/IAT unhooking, indirect syscalls, BYOVD EDR termination and a tweaked Process Ghosting loader. First disclosed .
Key facts
| Identifiers | TL-2026-5861 |
|---|---|
| Also known as | KGB cryptor (predecessor per ESET) |
| Severity | HIGH |
| First disclosed | |
| Affected products | Microsoft Windows (endpoints running AV/EDR) |
| Attribution | TA4922 (low confidence) |
| Nation-state nexus | China |
| Malware | 404 Keylogger, AdaptixC2, Agent Tesla, AsyncRAT, Cruciferra, Crypter, DarkCloud Stealer, Formbook, MoqHao, Phantom Stealer, ValleyRAT, XWorm |
| MITRE ATT&CK techniques | T1027.002 Software Packing, T1055.012 Process Injection: Process Hollowing, T1055.013 Process Doppelgänging, T1059.001 PowerShell, T1070.004 Indicator Removal: File Deletion, T1102.001 Web Service: Dead Drop Resolver, T1105 Ingress Tool Transfer, T1106 Native API, T1112 Modify Registry, T1140 Deobfuscate/Decode Files or Information, T1189 Drive-by Compromise, T1204.002 Malicious File and 10 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | finance, health, government administration, education, hospitality, travel |
| Target regions | Turkiye, greece, spain, india, united states of america, Global |
| Detection rules | 9 (1 shown free) |
| Sources | 8 cited sources |
Detection coverage
As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5861 across Splunk SPL, Microsoft KQL and Sigma, covering 51 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Cruciferra Crypter DLL Side-Loading from Extracted Archive (mscoree.dll / Unsigned Neighbour DLL)
Detects the Cruciferra crypter execution pattern: an executable launched from an extracted ZIP/RAR/7z archive (Temp\TempN_*.zip) that loads an unsigned DLL from that same archive folder (the DLL carries the Cruciferra payload and decoy exports), a mscoree.dll loaded from outside the Windows system/.NET directories (eSentire-observed Cruciferra DLL), or the known Cruciferra mscoree.dll SHA256. Cruciferra wraps AsyncRAT, XWorm, zgRAT, Remcos and other payloads, so catching the loader catches the delivery regardless of payload family.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1574.001, T1204.002, T1027.002
- Data sources: sysmon
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 earliest=-24h
```TL-2026-5861 Cruciferra DLL side-loading T1574.001 T1204.002 T1027.002 - requires Sysmon EventCode 7 image-load logging```
| eval is_archive=if(match(Image,"(?i)temp.temp[0-9]+_.+?[.](zip|rar|7z)."),1,0), arch_dir=lower(replace(Image,"(?i)^(.*temp.temp[0-9]+_.+?[.](zip|rar|7z)).*$","\1"))
| eval sideload_unsigned=if(is_archive=1 AND Signed="false" AND match(lower(ImageLoaded),"[.]dll$") AND substr(lower(ImageLoaded),1,len(arch_dir))=arch_dir,1,0)
| eval fake_mscoree=if(match(lower(ImageLoaded),"mscoree[.]dll$") AND NOT match(lower(ImageLoaded),"^c:.windows.(system32|syswow64|microsoft[.]net|winsxs)"),1,0)
| eval known_hash=if(match(lower(Hashes),"0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce"),1,0)
| where sideload_unsigned=1 OR fake_mscoree=1 OR known_hash=1
| stats count dc(ImageLoaded) AS dll_count values(ImageLoaded) AS loaded_dlls values(Hashes) AS hashes min(_time) AS first_seen max(_time) AS last_seen BY host, User, Image, sideload_unsigned, fake_mscoree, known_hash
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
// TL-2026-5861 Cruciferra DLL side-loading (T1574.001, T1204.002, T1027.002)
let knownHashes = dynamic(['0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce']);
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName endswith '.dll'
| extend ArchiveDir = tolower(extract(@"(?i)^(.*temp.temp[0-9]+_.+?[.](zip|rar|7z))", 1, InitiatingProcessFolderPath))
| extend SideLoad = isnotempty(ArchiveDir) and tolower(FolderPath) startswith ArchiveDir
| extend FakeMscoree = tolower(FileName) == 'mscoree.dll' and not(tolower(FolderPath) matches regex @"^c:.windows.(system32|syswow64|microsoft[.]net|winsxs)")
| where SideLoad or FakeMscoree or SHA256 in (knownHashes)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, FileName, FolderPath, SHA256, SideLoad, FakeMscoree
| order by Timestamp descSigma
title: Cruciferra Crypter DLL Side-Loading from Extracted Archive
id: 7c1f3a52-9d84-4e0b-a3c6-51b8d2e49f10
status: experimental
description: Detects an unsigned DLL loaded by an executable running from an extracted archive folder (Temp TempN zip), a mscoree.dll loaded from outside the Windows system directories, or the known Cruciferra mscoree.dll hash (TL-2026-5861).
references:
- https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service
- https://cybersecuritynews.com/cruciferra-malware-as-a-service/
author: Threadlinqs Team
date: 2026-11-12
tags:
- attack.defense-evasion
- attack.t1574.001
- attack.execution
- attack.t1204.002
- attack.t1027.002
logsource:
category: image_load
product: windows
detection:
selection_archive_exe:
Image|re: '(?i)temp.temp[0-9]+_.+[.](zip|rar|7z).+[.]exe$'
ImageLoaded|re: '(?i)temp.temp[0-9]+_.+[.](zip|rar|7z).+[.]dll$'
Signed: 'false'
selection_mscoree:
ImageLoaded|re: '(?i).mscoree[.]dll$'
filter_mscoree_legit:
ImageLoaded|re: '(?i)^c:.windows.(system32|syswow64|microsoft[.]net|winsxs).'
selection_hash:
Hashes|contains: 'SHA256=0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce'
condition: selection_archive_exe or (selection_mscoree and not filter_mscoree_legit) or selection_hash
falsepositives:
- Portable applications run directly from an extracted ZIP that ship their own unsigned helper DLLs
- Software installers extracted to Temp that load bundled unsigned DLLs
level: high
Known false positives:
- Portable applications run straight from an extracted archive that load unsigned helper DLLs
- Software installers unpacked under Temp that load bundled unsigned DLLs
- Developer tools executed from extracted archives
Tuning notes: Requires Sysmon EventCode 7 (ImageLoad) enabled. Adjust the index name (sysmon) to your environment. Allowlist known portable software by Image, signer or hash. For a very low-noise variant keep only the fake_mscoree and known_hash branches. Correlate with EventCode 11 (recent DLL creation) to raise confidence.
- Cruciferra Delivery: Hidden PowerShell Download from LNK or ClickFix Command · unlock with TL Creds
- Cruciferra BYOVD: Vulnerable Driver Dropped, Registered as a Service or Loaded for EDR Termination · unlock with TL Creds
- Cruciferra RAT C2: User-Writable Process Beaconing to Dynamic-DNS Hosts, Port 56001 or Known C2 / Sibling C2 Endpoints · unlock with TL Creds
- Cruciferra Lure Archive Written to Disk (Tax-Number, photo, YourSSA_Documents) · unlock with TL Creds
- Cruciferra UAC Bypass via COM Elevation Moniker (CMSTPLUA dllhost Child Process / Elevation:Administrator!new Moniker) · unlock with TL Creds
- Cruciferra Final-Stage Injection: Process Ghosting / Image Tampering (Sysmon EventCode 25) · unlock with TL Creds
- Cruciferra Persistence: Run Key 'putty' and Notification Suppression Registry Writes · unlock with TL Creds
- Cruciferra Payload Staging and RAT C2 Infrastructure Contact (DNS and Network) · unlock with TL Creds
Indicators of compromise
As of 2026-11-14, Threadlinqs Intelligence tracks 51 indicators of compromise for TL-2026-5861.
Sample indicators (3 of 51)
- IP address:
89.34.90[.]99 - Domain:
gatuso[.]duckdns[.]org - URL:
hxxps://almacensantangel[.]com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar
Defanged, TLP:CLEAR. Full set of 51 indicators: unlock with TL Creds.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
Technical analysis
Cruciferra is a crypter-as-a-service written in Mono that wraps commodity malware to evade antivirus and EDR. Proofpoint (Threat Insight, 2026-07-20) describes it as an umbrella name for several bundled crypters, first offered in fall 2025 and advertised on the exploit.in forum and likely elsewhere, with tiered pricing of $450 to $2,000 USD per month. Per the Cyber Security News article of 2026-11-12, which cites ESET, the service has been sold since October 2025, is a rebrand of the long-running KGB cryptor, and ESET has blocked 700,000+ compromise attempts since January 2026 (Turkiye, Greece and Spain most affected). The ESET claims were not independently verified against an ESET primary publication; the cited source is an ESET X post. Proofpoint observed dozens of campaigns from several unrelated groups, each of several hundred to thousands of messages, with opportunistic targeting (financial services 34%, healthcare 25%, government 10%, education 7%).
Execution is always via DLL side-loading: a ZIP/archive (or VHD) contains a legitimate-looking executable plus a DLL holding the Cruciferra code, and the executable invokes the DLL's main routine. DLLs may carry hundreds or thousands of decoy exports pointing at junk code to slow analysis. The loader checks for sandboxes/analyst VMs, hides console windows (EnumWindows/ShowWindow SW_HIDE loop), suppresses notifications via registry (ToastEnabled, Balloon, ShowInfoTip), maps a clean copy of ntdll to unhook functions and repairs the IAT, and uses indirect syscalls (NtProtectVirtualMemory, NtCreateSection, NtMapViewOfSection, NtCreateTransaction, NtRollbackTransaction, NtOpenKey, NtSetValueKey, NtSetInformationFile). If not admin it attempts a UAC bypass through the COM Elevation Moniker, and persists with a Run key whose default value is 'putty'.
Payloads are stored in the .reloc section behind an 'egg' marker, encoded in Base16 with the custom alphabet 'PQRSTUVWXYZ[\]^_', and protected by 90+ hybrid encryption algorithm variants (Keccak, SPECK-128/256 CTR, modified Threefish-256 CTR, Feistel and ARX constructions, DES-CBC-PKCS7), often randomly generated per build; debug timestamps suggest a new build every few minutes. For EDR tampering the loader drops a signed vulnerable driver, most often GoFlyDrv.sys (also Core64.sys, HwOs2Ec.sys, LnvMSRIO.sys, MemoryInformer.sys, NTIOLib_X64.sys, ProcessMonitorDriver.sys, selfprot.sys) and sends termination IOCTLs to EDR processes; an eSentire-observed loader (as reported by Cyber Security News) used DCRCVDrv.sys to end 145 AV/EDR-related processes. Final injection uses a customised Process Ghosting that additionally patches ZwQueryVirtualMemory hooks to sanitize EDR memory queries and neuters NtManageHotPatch.
Observed campaigns: TA4922 (Chinese-speaking cybercrime actor, some overlap with Silver Fox per Security Affairs) sent four tax-themed waves (Income Tax Department of India lures, 28 Apr - 1 Jun 2026, up to 250 messages each) leading to AsyncRAT; a May 2026 campaign impersonating the US Social Security Administration used a VHD to deliver XWorm and AdaptixC2; a late-June 2026 guest-complaint campaign against hospitality/travel used a zipped LNK that launched PowerShell to fingerprint the host and download a ZIP delivering zgRAT. Other observed payloads include Agent Tesla, DarkCloud, Formbook/XLoader, PhantomStealer, Remcos, Snake Keylogger, ValleyRAT and, via an ErrTraffic ClickFix-linked loader reported by eSentire, Remus stealer. No CVEs are involved and no state attribution is stated.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027.002 Software Packing; T1055.012 Process Injection: Process Hollowing; T1055.013 Process Doppelgänging; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564.003 Hidden Window; T1574.001 DLL
Execution
T1059.001 PowerShell; T1106 Native API; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Command and Control
T1102.001 Web Service: Dead Drop Resolver; T1105 Ingress Tool Transfer
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Persistence
T1543.003 Create or Modify System Process: Windows Service; T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1548.002 Bypass User Account Control
Resource Development
Remediation
Immediate actions
- Block the listed payload URLs, C2 domains and IP 89.34.90.99 at the proxy/DNS/firewall
- Hunt for a Run key with default value 'putty' under HKCU/HKLM Software\Microsoft\Windows\CurrentVersion\Run
- Hunt for newly installed driver services (GoFlyDrv.sys, Core64.sys, DCRCVDrv.sys and other listed drivers) and block the listed driver hashes
- Alert on executables launched from extracted archives that load an unsigned neighbouring DLL (DLL side-loading)
Workarounds
- Block or detonate ZIP/RAR/VHD attachments and links from external senders
- Restrict mounting of VHD files and execution from user-writable extraction directories
Longer-term hardening
- Enable Microsoft vulnerable driver blocklist / HVCI so BYOVD drivers cannot load
- Enable PowerShell script block and module logging
- Deploy EDR with tamper protection and alert on EDR process termination or sensor silence
- Train staff to distrust unexpected tax, government-benefit and guest-complaint emails and to never paste commands copied from web pages (ClickFix)
Affected and fixed versions
- Microsoft — Windows (endpoints running AV/EDR)
Vulnerable versions: All supported Windows versions without vulnerable-driver blocklist enforcement
Timeline
Last updated · revalidated 1× · latest source
- Cruciferra first sold on underground forums (October 2025 per ESET, via Cyber Security News; Proofpoint says fall 2025; day is a month-level placeholder)
- ESET begins counting 700,000+ blocked Cruciferra-related compromise attempts (January 2026, month-level precision)
- TA4922 tax-themed campaign delivers AsyncRAT via Cruciferra ZIP (Tax-Number52563.zip) from *.gu.cc staging URLs
- Second TA4922 AsyncRAT wave using 13 *.gu.cc URLs (Tax-Number809863.zip)
- SSA-impersonation campaign delivers XWorm and AdaptixC2 via VHD and Cruciferra; C2 locked-ioc-36
- Third TA4922 wave shifts staging to .love/.live domains (Tax-Number119863.zip, Tax-Number101863.zip)
- Fourth TA4922 AsyncRAT wave (Tax-Number33863.zip) using .love/.live domains
- Guest-complaint lure campaign against hospitality/travel delivers zgRAT via zipped LNK, PowerShell and Cruciferra; C2 locked-ioc-44:56001
- Proofpoint observes multiple Cruciferra builds between 02:53 and 03:34, indicating new builds every few minutes
- Proofpoint publishes 'Unpacking Cruciferra' analysis
- eSentire TRU publishes analysis of ErrTraffic ClickFix campaigns (late July 2026) delivering Cruciferra PUROSANGUE with the locked-ioc-40 EDR killer (145 processes) and Remus infostealer.
- ESET reports Cruciferra as a KGB cryptor rebrand with 700,000+ blocked attempts; Cyber Security News publishes IOCs incl. eSentire loader using locked-ioc-40 and Remus stealer
Update history
- 2026-11-14 — Cruciferra cryptor-as-a-service: ClickFix delivery, EDR-killing BYOVD (locked-ioc-40) and process ghosting; 700,000+ attempts blocked by ESET: What changed No field escalation: severity HIGH, exploitability ACTIVE, status ACTIVE already match the newer report. Update adds primary-source eSentire detail to the existing record.
Sources cited
- Unpacking 'Cruciferra': An Analysis of a Sophisticated Crypter Service (Proofpoint) Proofpoint · Research · 2026-07-20
- ESET Research post on Cruciferra (X) x.com · Research · 2026-11-12
- Cruciferra: Analyzing a Sophisticated Crypter Service (SOC Prime) socprime.com · Blog
- Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans cybersecuritynews.com · News · 2026-11-12
- This $2,000-a-Month Crypter Can Kill EDR and Make Malware Disappear From Disk cybersecuritynews.com · News · 2026-07-21
- New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide (Security Affairs) securityaffairs.com · News
- Cruciferra Crypter Uses Process Ghosting to Evade Detection (Infosecurity Magazine) infosecurity-magazine.com · News
- Cruciferra Crypter Evades Detection to Deliver Malware (eSecurity Planet) esecurityplanet.com · News
More from TA4922
- AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate
- WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task Scheduler (PoolParty Variant 7) to Run as SYSTEM
- TA4922 Deploys PackClient RAT via Tax-Themed Phishing Against Organizations in China and India
- Atlas RAT — Chinese-Speaking TA4922 Goes Global with RomulusLoader & SilentRunLoader (Europe/Africa Expansion)
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated . Reviewed .
