Cruciferra crypter uses vulnerable drivers and process ghosting to hide malware

Researchers detailed Cruciferra, a crypter service that packages Windows malware to evade detection using two notable techniques. It brings a vulnerable signed driver to disable security tooling, an approach known as bring-your-own-vulnerable-driver, and it uses process ghosting, where a malicious file is deleted before its code is mapped into a running process, so the running program has no backing file for tools to inspect. Together these let common payloads run while sidestepping many endpoint defenses. Crypter services matter because they lower the skill needed to deploy malware stealthily, letting many separate actors wrap their payloads in the same evasion layer rather than building it themselves.

Check

Enable vulnerable driver blocklisting on Windows, hunt for known bad drivers being loaded, and ensure endpoint tooling can detect process ghosting rather than relying on scanning files on disk.

Affected

Windows environments relying on file-based or easily disabled endpoint defenses; Cruciferra-wrapped malware disables protections through a vulnerable driver and runs with no backing file to scan.

Fix

Turn on Microsoft's vulnerable driver blocklist, restrict driver loading, deploy behavior-based detection that catches process ghosting and driver abuse, and alert on unexpected kernel driver installs.