Cybersecurity researchers have identified a growing market for "crypting" services, which enable threat actors to modify malicious payloads to evade detection by antivirus (AV) and endpoint detection and response (EDR) tools. These services are becoming increasingly sophisticated, offering a range of features beyond basic encryption to complicate analysis and preserve malware usability.
A recent analysis of 24 threat actors advertising crypting services over the past year reveals a competitive, reputation-driven market primarily focused on Windows payloads. Providers advertise through underground forums, restricted communities, chat platforms like Telegram and TOX, clearnet websites, and social media. They compete on pricing tiers, reported AV detection scores of crypted samples, discounts, partnerships with malware developers, private or shared "stubs" (the wrapper code for the encrypted payload), and rapid turnaround times for re-crypting detected payloads.
The core function of a crypting service is to encrypt a malicious executable, making it harder for security solutions to identify. However, advanced providers offer additional capabilities such as payload wrapping, in-memory execution, anti-analysis checks (e.g., preventing execution in virtual environments or sandboxes), process injection, persistence options, and delivery packaging. Some even provide "cleaning" or re-crypting services after a payload has been detected.
While the individual techniques used by crypters are often not novel, their commercial packaging makes established defense-evasion tradecraft more accessible and operational for a wider range of threat actors. The primary objectives remain consistent: reduce detection, delay or prevent analysis, and support stealthier payload execution.
The risk associated with crypted payloads varies with the provider's maturity and technical capability. Advanced crypters offer portability, robust anti-analysis features, process injection, persistence, and security product bypasses, whereas less advanced services typically provide only basic payload obfuscation.
Crypting services are predominantly advertised for Windows .exe and .dll payloads, with no identified advertising for macOS or Linux. The programming language of the payload (e.g., .NET, C, C++) can also influence the available capabilities or compatibility with certain crypting services.
Partnerships between malware developers and crypting service providers are common. For instance, "GoldenCrypt," a well-established provider on underground forums, has reputational ties to multiple malware families, including FvncBot, Albiriox, and Mirax. These affiliations often serve as a marketing strategy, potentially involving kickbacks and enhancing the provider's reputation.
Pricing for crypting services is typically tiered, based on factors such as the volume and type of files to be encrypted, the duration of service, the provider's reputation, the promised "fully undetectable" (FUD) status of the crypted payload, and additional features. Providers often use multi-AV scanning platforms like KleenScan to demonstrate FUD status, as these services allow scanning without storing samples that could be exposed to researchers.
While crypted payloads increase the likelihood of successful malware execution and delayed detection, they do not independently provide end-to-end intrusion capabilities. Subsequent activities like lateral movement, data theft, ransomware deployment, or further compromise depend on the embedded malware and the operator's objectives.
Security experts advise that AV and EDR tools alone are insufficient protection against crypted payloads. Defenders should prioritize behavioral detection, telemetry correlation, upstream hunting, suspicious process monitoring, and rapid triage of suspicious samples to effectively counter this evolving threat.
