This $2,000-a-Month Crypter Can Kill EDR and Make Malware Disappear From Disk

Proofpoint identified a commercial crypter called “Cruciferra” (sold by subscription) that has been used since late 2025 to wrap and deliver multiple RATs and information-stealers (AsyncRAT, XWorm, zgRAT, Agent Tesla, Formbook, Remcos, XLoader) via DLL side‑loading, process ghosting, and BYOVD attacks using signed vulnerable drivers; campaigns used tax, SSA, and complaint-themed lures across email, PDFs, ZIPs and other artifacts, targeting financial, healthcare, government, travel, and hospitality sectors and including numerous IoCs (URLs, file hashes, drivers).