Loading story…
Recorded Future's Insikt Group identified a competitive underground market of at least 24 active malware crypting service providers selling tools that modify malicious payloads to evade antivirus and endpoint defenses. The offerings are marketed across underground forums, restricted communities, messaging platforms, clearnet sites, and social media, with most focused on Windows payloads and advertising bypasses for Microsoft Defender, SmartScreen, AMSI, ETW, Chrome warnings, and broader AV/EDR controls.
The services go beyond basic packing or encryption and increasingly bundle broader malware-enablement features, including in-memory execution, anti-VM and anti-sandbox checks, process injection, persistence, delivery packaging, polymorphic or per-build stubs, and re-crypting after detection. Sellers support formats such as EXE, DLL, .NET, scripts, Office files, PDFs, MSI packages, APKs, and shortcut-based launchers, with pricing ranging from tens of dollars to tens of thousands; while most vendors show no confirmed ties to malware developers, some listings suggest possible links to actors or families including TrickBot, Conti, Agent Tesla, PureRAT, and BianLian, underscoring how established defense-evasion techniques are being commercialized for wider criminal use.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
Insikt Group published analysis of 24 crypting-service providers active within the past year, describing a competitive malware-enablement market centered largely on Windows payloads and broader defense-evasion capabilities.
Recorded Future published research cataloging underground crypter and packer sellers, their pricing, claimed evasion features, supported payload formats, and possible malware-family affiliations.
A seller active since February 2026 began offering subscription tiers from $80 for three files to $700 for 50 files, advertising personalized encryption and extended detection evasion.
Recorded Future says a seller active since October 2025 began offering Shared Cruciferra, Purosangue AV-Killer, and Coconut Single Executable plans with claims of Defender and Chrome bypass, AV process termination, and persistence protection.
A seller active from April 2025 to October 2025 offered EXE and DLL crypts priced from $225 to $475 and claimed Defender and SmartScreen evasion; open-source data suggested a relationship with PureRAT.
A July 2025 eSentire report associated the PureRAT RAT and GhostCrypt crypting service with the earlier attack on a public US accounting firm.
Recorded Future describes a seller active since July 2025 that offered Standard, Private, and Premium crypting tiers priced at $60, $80, and $100, and notes possible ties to AURA Stealer based on forum posts.
The Malware News summary cites an eSentire report associating the PureRAT remote access trojan and GhostCrypt crypting service with an attack that impacted a public US accounting firm in May 2025.
A seller active since April 2025 began offering web-based payload crypting and packing for VBS, BAT, and JS payloads, with plans ranging from one week to three months.
Recorded Future says another seller became active in 2023, advertising public stubs for $69.90 and private stubs for $150 with Defender evasion and Telegram support.
A seller focused on APK obfuscation was described as active since 2022, offering tiered pricing for daily Android package crypting services.
One profiled seller was described as active since 2021, offering a normal crypter for $500 and a crypter bundled with an EV certificate for $2,500.
The Recorded Future profile states Bentley was active from 2020 to 2023 selling crypts, and leaked Conti chats implicated Bentley as officially affiliated with TrickBot and involved in developing and administering Conti.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers. The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Jun 29, 2026