Cruciferra Crypter Uses Process Ghosting to Evade Detection

Proofpoint research documents a commercial crypter called 'Cruciferra' used by multiple criminal operators to deliver RATs and keyloggers via DLL side‑loading; the crypter employs advanced techniques — custom mix‑and‑match cryptographic routines, BYOVD kernel driver abuse to disable EDR, and a hardened form of process ghosting — and has been linked to active campaigns (including TA4922) targeting financial, healthcare and government organizations.