Cruciferra Malware: A Crypter for Hire With Over 90 Encryption Routines, What Is Confirmed and What Businesses Should Check

Cruciferra is a criminal service that hides malware inside layers of encryption so security software has a harder time spotting it. ESET says it has blocked over 700,000 compromise attempts linked to it. For a business, this is not one virus with one patch. It is a paid tool that any number of attackers can use to sneak their own malware onto company computers.

There is no software update that fixes this. The useful work this week is checking that the protection on every company device is actually running, and keeping clear about what researchers have confirmed and what the criminals selling Cruciferra only claim.

What is Cruciferra?

Cruciferra is a malware-as-a-service cryptor. Researchers spell it both ways, cryptor and crypter, and you will see both in search results. In plain terms, Cruciferra does not attack anything by itself. Criminals pay for it, give it their malware, and get back a disguised copy. The reports describe it as a cryptor that uses more than 90 encryption routines to conceal malicious payloads.

Proofpoint's researchers analysed the service. They say Cruciferra can use any one of over 90 different encryption algorithms. They also report its prices: from $450 USD a month up to $2,000 USD a month, in tiers.

According to Cyberpress, researchers identified Cruciferra as a rebrand of the long-running KGB cryptor. It has been sold to cybercriminals since October 2025. So this is not a new operation. It is an older tool with a new name.

The sellers' own advertising calls it "the underground's most lethal crypter." Treat that as a sales pitch from criminals, not a finding.

Cruciferra: what is confirmed and what is claimed

The 700,000 number counts attempts that ESET says its products stopped. It does not count successful infections. None of the sources we checked say how many attacks got through.

What is not known about Cruciferra

Plenty of basic questions have no answer in the sources we checked. We are not going to fill those gaps with guesses:

• What malware it hides. The sources do not name the malware families that criminals have wrapped with Cruciferra.
• How it reaches victims. They do not say whether it arrives by email attachment, fake download or some other route.
• What to search for. They give no file names or other indicators that an IT team could look for.
• The time period. The sources do not say what period ESET's 700,000 figure covers.
• Who else was hit. Türkiye, Greece and Spain are named as the most affected countries. The sources do not give a full list, and they do not say whether businesses in the United States were targeted.

Who is affected by Cruciferra?

The most affected countries were Türkiye, Greece and Spain. Beyond that, the people actually at risk are whoever the paying criminals choose to target. Cruciferra is the wrapper, not the attack, so it can show up with whatever malware a customer gives it.

That is why a business outside those three countries should still pay attention. A service sold to cybercriminals since October 2025 does not care where its customers point it.

Why a crypter matters for a company network

Most businesses lean on security software to catch bad files before they run. A crypter exists to get around that. If the disguise works, a harmful file can look harmless at the moment an employee opens it.

Some things make this one worth taking seriously:

• It is for hire. At $450 a month for the entry tier, it is within reach of a wide range of criminals, not just well-funded groups.
• It has been around for a while. As a rebrand of the KGB cryptor, it comes from people who have been in this business for some time.
• The damage depends on what is inside. The crypter decides whether malware gets past your defences. The malware decides what happens next, whether that is stolen passwords, lost files or a locked network.

We wrote about another case of malware dressed up to look harmless in our post on Abe Office malware. The pattern is the same: assume a disguised file can reach a desk, and make sure there is more than one layer between that file and your data.

What to do about Cruciferra this week

There is no fixed version to install, because Cruciferra is not a flaw in your software. These checks are general good practice for any disguised malware. They are not specific Cruciferra settings, because the sources do not publish any.

If nobody owns these checks today, read who is patching the software that runs your business. The same gap applies to security alerts.

Cruciferra questions people are asking

What is Cruciferra malware?

Cruciferra is a malware-as-a-service cryptor. Criminals rent it to hide their malware using more than 90 encryption routines, so security tools have a harder time spotting the malicious payload.

What is a crypter or cryptor?

It is a tool that wraps malware in encryption to disguise it. The two spellings mean the same thing. A crypter is not the attack itself. It is the disguise around the attack.

Is Cruciferra the same as the KGB cryptor?

According to Cyberpress, researchers identified Cruciferra as a rebrand of the long-running KGB cryptor. It has been sold under the new name since October 2025.

How much does Cruciferra cost criminals?

Proofpoint reports tiered prices from $450 USD a month to $2,000 USD a month.

Which countries are most affected by Cruciferra?

Türkiye, Greece and Spain were the most affected countries. The sources do not give a full list.

Has Cruciferra been seen in the United States?

The sources we checked do not say. They do not say it has been, and they do not say it has not.

Is there a patch for Cruciferra?

No. Cruciferra is a criminal tool, not a bug in a product you own, so there is nothing to patch. Protection comes from working security software, limited user rights and someone actually watching the alerts.

How many attacks has ESET blocked?

ESET says it has blocked over 700,000 compromise attempts linked to Cruciferra. The sources do not say what period that covers or how many attempts got through.

The bigger lesson

Criminal tools change their names and disguises. KGB became Cruciferra, and the next version will look different again. What stays the same is the defence: protection running on every device, updates switched on, staff without everyday admin rights, and a named person who reads the alerts and knows what to do when one fires. A business that has those basics in place does not need to win against every new crypter. It just needs to be ready when one gets through.

See how we harden company systems at /tech/security-hardening, or ask for a quote at /get-a-quote/tech.

Get security alerts by email, plus the free checklist, at /security-alerts.

Sources: Proofpoint: Unpacking Cruciferra; Cyberpress; GBHackers.