The point: A commercialized obfuscation service featuring over 90 encryption routines is already being deployed in large-scale malware campaigns against the financial sector and critical infrastructure, making signature-based detection increasingly ineffective.
Security researchers at Proofpoint have discovered Cruciferra, an obfuscation service for malware that is already established in the cybercrime underground and supporting numerous attack campaigns. The system combines more than 90 encryption methods and additional evasion techniques to circumvent classical security solutions.
Cruciferra operates as a commercialized crypter service in the underground, available to various attackers for payment — in contrast to proprietary tools of individual hacker groups. Initial mentions appeared in autumn 2025 in underground forums, where the service was actively promoted. Proofpoint documented both productive versions and test and debug variants with experimental extensions, suggesting continuous development.
The technical sophistication of Cruciferra lies in the combination of numerous evasion methods: system calls are obfuscated, security functions are manipulated, and malicious code is executed with minimal traces. The service features more than 90 different cryptographic routines that can be flexibly combined, so individual malware files vary significantly — this greatly complicates signature-based detection. Abused drivers also enable partial circumvention of endpoint protection solutions.
Cruciferra has thus far been used to obfuscate various remote-access trojans (AsyncRAT, XWorm, Remcos) and infostealers (AgentTesla, XLoader, Phantom Stealer, Formbook, zgRAT) in email-based campaigns. The attacks follow an opportunistic approach and are not targeted at specific victims, but are conducted on a large scale against high-value industries: the financial sector, healthcare, and public sector were most heavily affected. Campaign sizes varied considerably — from several hundred to several thousand emails per wave.
The professionalization of the cybercrime market is evident in this business model: attackers outsource specialized functions instead of developing tools themselves. This gives even technically less sophisticated actors access to powerful obfuscation techniques. For CISOs, this development means that signature-based protection measures alone are increasingly insufficient — modern defense requires behavioral detection, continuous network monitoring, and rapid incident response capabilities.
Source: www.it-daily.net · Published 22 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.