Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide RATs and Infostealers

The report describes 'Cruciferra', a Mono-based commercial crypter used by multiple actors to evade detection and deploy various malware (AsyncRAT, zgRAT, Agent Tesla, Remcos, XLoader, Formbook, stealers and keyloggers). It summarizes observed phishing delivery chains (tax- and agency-themed lures), technical evasion techniques including BYOVD use of vulnerable kernel drivers and API hook removal, ties several campaigns to suspected TA4922 operations, and provides example indicators of compromise.