Filtered by tag: byovd × Clear
Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans
Matched: health
Cybercriminals are renting a crypter tool called Cruciferra to hide infostealers and RATs from security software. Priced at $450–$2,000 monthly, it uses 90+ encryption routines, DLL side-loading, sandbox detection, and BYOVD driver attacks to evade defenses. Active since October 2025 and linked to the older KGB cryptor, it has prompted over 700,000 blocked compromise attempts since January 2026, primarily targeting Türkiye, Greece, and Spain. Payloads include AsyncRAT, XWorm, and Agent Tesla.
Anubis Ransomware Hackers Deploy New Lindnor Backdoor and 13 Security-Killing Tools in U.S. Attack
Matched: health
Attackers using Anubis ransomware targeted a U.S. organization in October 2026, deploying a new custom backdoor called Lindnor and 13 tools designed to disable security software. Symantec blocked the encryption payload before it executed. The Anubis group, tracked as Hawkmoth, operates a RaaS platform rebranded from Sphinx ransomware in December 2024 and has claimed roughly 96 victims, 52% in the U.S. Defenders should monitor for Lindnor's known hashes, suspicious drivers, and AnyDesk installations.