Cruciferra Crypter Hide Windows Malware Using BYOVD and Process Ghosting

The China‑linked cybercrime group behind income tax–related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated threat clusters to deliver a wide array of remote malware payloads into victims’ systems while remaining undetected by conventional endpoint protection tools.¹

Cruciferra’s core technique relies on “BYOVD” (Build Your Own Virtual Device), which allows attackers to dynamically load malicious code within a legitimate process or virtual machine that is not typically monitored by security software. The crypter also employs process ghosting, embedding the malicious code inside normal operating system functions so that even if an infected machine appears clean through standard AV scans, additional layers remain hidden until specialized reverse engineering tools are applied. This approach builds on earlier tactics seen with APT10's Operation Cloudburst from 2017 onward where they used living off the land binaries for persistence after initial compromise but it has evolved significantly as detection capabilities improved.

From a privacy perspective, the use of BYOVD means that financial data exfiltration can occur without obvious signs in logs or network traffic, making it harder for organizations to detect and respond promptly. Experts note that similar techniques were employed by APT41 in 2019, hiding activity inside Microsoft Office processes; Cruciferra’s modularity suggests a more sophisticated operation than previously observed. Indian tax sector officials have expressed concern over repeated targeting, noting that Lazarus Group had deployed VBScript droppers against the same industry late 2023, indicating that these attacks likely aim at financial data rather than disruption.

The implications extend beyond malware detection: smaller businesses facing economic downturn pressures may lack the budget for advanced endpoint protection systems capable of detecting such obfuscation. As costs rise, many organizations struggle to keep up amid rising inflation rates, potentially leaving them vulnerable to exploitation through supply chain security gaps in accounting software and payroll systems. CERT‑In is expected to increase scrutiny around these areas, urging tighter controls on third‑party components and stricter monitoring of process integrity within finance departments.

Cruciferra’s adoption of BYOVD and process ghosting represents a significant evolution in malware delivery tactics, raising both technical and operational challenges for defenders while underscoring the need for enhanced visibility into legitimate process usage across corporate environments.