Full Report
The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote
Analysis Summary
# Tool/Technique: Cruciferra Crypter
## Overview
Cruciferra is a sophisticated, Mono-based crypter-as-a-service (CaaS) used to obfuscate and deliver various malware families. It is marketed on the cybercrime underground as a "lethal" solution for evading EDR and antivirus detection. It employs advanced evasion techniques, including Bring Your Own Vulnerable Driver (BYOVD) and Process Ghosting, primarily targeting financial, healthcare, and government sectors.
## Technical Details
- **Type:** Crypter / Malware Loader
- **Platform:** Windows (utilizes Mono framework)
- **Capabilities:** Evasion, Anti-Analysis, EDR Disabling, Privilege Escalation, Persistence.
- **First Seen:** Fall 2025 (Advertised for $450 - $2,000/month).
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1574.001 - Hijack Execution Flow: DLL Side-Loading
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1064 - Scripting (Mono)
- T1562.001 - Impair Defenses: Disable or Modify Tools (BYOVD)
- T1548 - Abuse Elevation Control Mechanism
- T1601.001 - Modify System Image: Indirect Syscalls / API Unhooking
- T1140 - Deception: Process Ghosting
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
## Functionality
### Core Capabilities
- **Polymorphic Encryption:** Uses dynamically derived encryption routines combined from known PRNG and hashing algorithms, creating unique variations for every sample.
- **Payload Delivery:** Can either drop an encrypted payload to disk or retrieve it from a remote staging server.
- **DLL Side-Loading:** Frequently executed via side-loading to appear as a legitimate process.
- **Multi-Malware Support:** Proven to deliver Agent Tesla, AsyncRAT, Remcos, Formbook, ValleyRAT, and others.
### Advanced Features
- **BYOVD (Bring Your Own Vulnerable Driver):** Specifically abuses the `GoFlyDrv.sys` driver to terminate security software and EDR processes.
- **Process Ghosting:** Executes payloads in a way that minimizes forensic artifacts on the disk.
- **Analysis Evasion:** Implements indirect system calls and unhooks Windows API/IAT (Import Address Table) to bypass monitoring.
- **Environmental Awareness:** Checks for virtualization or sandboxed environments before proceeding with execution.
## Indicators of Compromise
- **File Names:** `GoFlyDrv.sys` (Vulnerable driver used for BYOVD).
- **Network Indicators:**
- Staging/C2 Domains: `[example-malicious-domain].com` (defanged)
- Phishing Landing Pages: `[tax-theme-phishing].in` (defanged)
- **Behavioral Indicators:**
- Unexpected termination of security or EDR service processes.
- Presence of Mono-based executables in temporary or tax-related folders.
- DLL side-loading behaviors in common Windows applications.
## Associated Threat Actors
- **TA4922 (Silver Fox / Operation DragonReturn):** A China-linked group targeting Indian taxpayers.
- **Various unnamed cybercriminal clusters:** Generally used in opportunistic campaigns reaching thousands of targets.
## Detection Methods
- **Signature-based detection:** Difficulty is high due to polymorphic encryption; focus on the loader stub and the `GoFlyDrv.sys` driver hash.
- **Behavioral detection:** Monitor for unauthorized driver loading (BYOVD), API unhooking activities, and process ghosting patterns.
- **YARA rules:** Target the Mono-specific structures and the unique implementation of indirect syscalls.
## Mitigation Strategies
- **Driver Allowlisting:** Implement Microsoft’s vulnerable driver blocklist to prevent the loading of known exploited drivers like `GoFlyDrv.sys`.
- **Phishing Defense:** Enhance email filtering for ZIP files and tax-themed lures, especially those directing users to external landing pages.
- **Endpoint Hardening:** Enable Tamper Protection in EDR settings to prevent unauthorized process termination.
## Related Tools/Techniques
- **Process Ghosting:** Similar to Process Herpaderping or Hollowing.
- **EDR Killers:** Related to specialized tools that automate the disabling of security software.
- **Direct/Indirect Syscalls:** Advanced techniques used by Cobalt Strike and other high-end loaders.