ESET Blocks Over 700,000 Cruciferra Malware Attacks Leveraging Polymorphic Encryption and Advanced Evasion Techniques
Since its emergence in late 2025, the Cruciferra malware crypter has been involved in over 700,000 attack attempts blocked by ESET up to November 2026, primarily affecting Türkiye, Greece, and Spain. Cruciferra employs a polymorphic approach with more than 90 distinct encryption routines generated from well-known cryptographic components, enabling it to evade signature-based detection effectively. Distributed as malware-as-a-service (MaaS), Cruciferra supports delivery of multiple Remote Access Trojans (RATs) and keyloggers, with campaigns attributed in part to the Chinese-speaking group TA4922. The malware incorporates multilayer evasion techniques including DLL side-loading, EDR unhooking, the use of a vulnerable signed driver for process termination, and customized process ghosting. Infection vectors involve drive-by compromises of WordPress sites leading users to execute malicious PowerShell commands. Defenders are advised to monitor for vulnerable driver hashes, suspicious side-loading of mscoree.dll, and unusual PowerShell activity, emphasizing behavioral detection over static signatures due to Cruciferra’s encryption variability.
Linha do tempo
-
ESET Blocks Over 700,000 Cruciferra Malware Attacks Leveraging Polymorphic Encryption and Advanced Evasion Techniques
ler a análise desta fonte ocultar
Since its emergence in late 2025, the Cruciferra malware crypter has been involved in over 700,000 attack attempts blocked by ESET up to November 2026, primarily affecting Türkiye, Greece, and Spain. Cruciferra employs a polymorphic approach with more than 90 distinct encryption routines generated from well-known cryptographic components, enabling it to evade signature-based detection effectively. Distributed as malware-as-a-service (MaaS), Cruciferra supports delivery of multiple Remote Access Trojans (RATs) and keyloggers, with campaigns attributed in part to the Chinese-speaking group TA4922. The malware incorporates multilayer evasion techniques including DLL side-loading, EDR unhooking, the use of a vulnerable signed driver for process termination, and customized process ghosting. Infection vectors involve drive-by compromises of WordPress sites leading users to execute malicious PowerShell commands. Defenders are advised to monitor for vulnerable driver hashes, suspicious side-loading of mscoree.dll, and unusual PowerShell activity, emphasizing behavioral detection over static signatures due to Cruciferra’s encryption variability.