Hackers Use Cruciferra Crypter to Disable EDR and Deploy XWorm, Remcos, and AsyncRAT

Proofpoint analyzed Cruciferra, a Mono-based crypter-as-a-service actively used in global email campaigns to turn off EDR/endpoint protections and stealthily deploy RATs and stealers (AsyncRAT, XWorm, Remcos, Agent Tesla, etc.). The service employs layered defense-evasion (user-/kernel-mode unhooking, BYOVD vulnerable-driver abuse, indirect syscalls, polymorphic encryption with >90 routines) and flexible delivery (side-loaded DLLs, VHD/ZIP containers, staged downloads). Multiple crime clusters and TA4922 campaigns used tax, SSA, and hospitality lures to distribute Cruciferra-backed payloads across financial, healthcare, government, and travel sectors; the report includes numerous defanged IOCs and behavioral details for detection and tracking.