How Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Malware

Emily Davis · 2026-07-27

A cybercrime group linked to China has been caught using a clever new trick to hide malware on Windows systems. They're targeting Indian taxpayers, tax professionals, and corporate finance teams with phishing emails that look like official income tax notices. But the real story here is the tool they're using: a sophisticated crypter service called Cruciferra. According to a new analysis from Proofpoint, Cruciferra is being used by multiple unrelated cybercriminal groups to deliver a wide range of remote access trojans (RATs) and other nasty payloads. It's not just one crew—this thing is spreading across the underground. ### What Makes Cruciferra Different? Most malware delivery methods are pretty easy to spot if you know what to look for. But Cruciferra stands out because it uses two advanced techniques that make detection much harder: - **BYOVD (Bring Your Own Vulnerable Driver):** This technique exploits a legitimate, signed driver that has a known vulnerability. The attacker loads the vulnerable driver into the kernel, then uses it to disable security software or gain elevated privileges. Since the driver is signed by a trusted vendor, it often slips past antivirus. - **Process Ghosting:** This is a newer technique where the attacker creates a malicious process that looks like a legitimate one. It works by writing malware to a file, then deleting it before the process is fully created. The end result is a running process that has no corresponding file on disk, making it invisible to many security tools. Together, these methods allow Cruciferra to hide malware deep inside the operating system where traditional scanners can't reach. ### Who's Being Targeted? The phishing campaigns are specifically aimed at people in India—taxpayers, tax professionals, and corporate finance teams. The emails are designed to look like official communications from India's income tax department. They often mention refunds, tax notices, or penalties to create urgency. Once the victim clicks a link or opens an attachment, the Cruciferra crypter kicks in. It decrypts and executes the hidden payload, which could be anything from a keylogger to a full-blown RAT like Agent Tesla or AsyncRAT. > "Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote access trojans." — Proofpoint ### Why Should You Care? If you're in the cybersecurity field, this is a wake-up call. BYOVD and process ghosting are not new, but seeing them combined in a commercial crypter service means they're becoming more accessible to low-skilled attackers. That's bad news for everyone. For businesses, especially those with finance teams in India, this is a direct threat. A single compromised machine could lead to stolen credentials, financial fraud, or a full-blown ransomware attack. ### How to Protect Yourself Here are some practical steps: - **Train employees** to spot phishing emails, especially those that create urgency around taxes or refunds. - **Use application whitelisting** to block untrusted drivers from loading. - **Keep systems updated**—many BYOVD exploits rely on unpatched drivers. - **Deploy EDR (Endpoint Detection and Response)** tools that can detect process ghosting by monitoring for suspicious process creation patterns. ### The Bottom Line Cruciferra is a reminder that cybercriminals are constantly innovating. They're not just using old tricks—they're combining advanced techniques to stay ahead of defenses. For now, the best defense is awareness and layered security. Stay vigilant, and don't click on that urgent tax notice email without verifying it first.