Cruciferra

Victims first land on a hacked WordPress site. An obfuscated ErrTraffic script sits inside the page.

Proofpoint’s research team traced a wave of income-tax-themed lures targeting Indian taxpayers, tax professionals, and corporate finance teams... TA4922 sent victims to fake landing pages hosting ZIP files disguised as tax documents...

TA4922 sent victims to fake landing pages hosting ZIP files disguised as tax documents, with four separate waves identified between April and early June 2026.

Subsequent PowerShell stages use a legitimate Microsoft-signed program to side-load Cruciferra as mscoree.dll.

Attackers trick users into running PowerShell... The PowerShell command kicks off several stages.

API Hashing APIs needed for process enumeration and injection are resolved through a custom algorithm that hashes exports of kernel32.dll and ntdll.dll.

The lure copies a hidden PowerShell command to the clipboard. It then tells the user to open PowerShell and paste it. This social trick is called ClickFix.

The lure copied a malicious PowerShell command to the victim's clipboard and instructed them to paste and run it.

DLL side-loading de mscoree.dll (Cruciferra) via un binaire Microsoft signé

The crypter also seeks administrator rights, changes registry settings to suppress Windows notifications, and creates persistence after reboot.

T1543 — Create or Modify System Process (Persistence)

The loader then tries three ways to gain administrator rights, reaches SYSTEM, the highest level on a Windows machine, and installs the kernel driver as a service.

The crypter also seeks administrator rights, changes registry settings to suppress Windows notifications, and creates persistence after reboot.

...then plants itself in the registry’s Run key under the unassuming name “putty” so it survives a reboot.

The final payload is loaded into memory using a variant of Process Ghosting.

Then the loader uses process hollowing to inject the Remus information stealer into another signed binary, ServiceModelReg.exe.

This is a bring-your-own-vulnerable-driver technique, in which attackers use a real signed driver rather than an obviously malicious kernel component.

T1543 — Create or Modify System Process (Persistence)

The loader then tries three ways to gain administrator rights, reaches SYSTEM, the highest level on a Windows machine, and installs the kernel driver as a service.

The crypter also seeks administrator rights, changes registry settings to suppress Windows notifications, and creates persistence after reboot.

...then plants itself in the registry’s Run key under the unassuming name “putty” so it survives a reboot.

The Cruciferra loader abuses a vulnerable driver, DCRCVDrv.sys, to terminate a list of 145 security-related processes from the Windows kernel

The malware requires administrator privileges and attempts to elevate privileges via the COM Elevation Moniker.

Cruciferra adds an extra layer of sophistication by patching ZwQueryVirtualMemory hooks and by attempting to tamper with the NtManageHotPatch routine to hide the deletion of the file and neutralize integrity checks.

Crypters play an important role in the cybercriminal ecosystem as they allow bad actors to obfuscate their payloads, avoid detection, and improve malware delivery success rates.

The payload is a .NET 7.0 application compiled via NativeAOT, typically delivered through DLL side-loading.

The algorithm used to encrypt payloads and strings in each set of samples is different, and there is such a large variance of these algorithms, which means it is probably randomly generated (polymorphically).

...fake landing pages hosting ZIP files disguised as tax documents... One wave impersonated the US Social Security Administration...

The final payload is loaded into memory using a variant of Process Ghosting.

Then the loader uses process hollowing to inject the Remus information stealer into another signed binary, ServiceModelReg.exe.

Process Ghosting is when malware creates a temporary file, marks it for pending deletion via NtSetInformationFile... Once the file handle is closed, the operating system deletes the file from disk while the section persists in memory.

Payloads are encoded in the binary using Base16 encoding with a custom character set... After the decoding stage, the payloads... are stored in a simple file structure.

It relies on indirect system calls and Import Address Table repair to reduce visibility...

Subsequent PowerShell stages employ a legitimate Microsoft-signed binary to sideload the Cruciferra DLL.

Before releasing its payload, Cruciferra checks whether it is running in a sandbox or analyst virtual machine.

DLL side-loading de mscoree.dll (Cruciferra) via un binaire Microsoft signé

Proofpoint researchers identified both production and apparent testing samples, including variants containing debugging functionality and experimental features.

The crypter also seeks administrator rights, changes registry settings to suppress Windows notifications, and creates persistence after reboot.

Alinubx.sys carries a list of 145 antivirus and security process names and terminates each one it finds running.

The loader scans running processes and hashes their names. It then sends matching process IDs to the driver.

This script first fingerprinted the user's system and reported the collected information to an actor-controlled server.

Before releasing its payload, Cruciferra checks whether it is running in a sandbox or analyst virtual machine.

Proofpoint researchers identified both production and apparent testing samples, including variants containing debugging functionality and experimental features.

Victims receive an archive with an executable and DLL... Attackers have used... ZIP archives... In one campaign... led recipients to attacker-controlled ZIP downloads.

An obfuscated JavaScript injection contacts attacker-controlled infrastructure, retrieves the lure, and presents a verification page that looks routine.