Executive Summary
Crypting services and products modify malicious payloads to help threat actors bypass detection, complicate analysis, and preserve malware usability after exposure. Although basic crypting consists of encrypting or obfuscating a customer-supplied payload, mature providers increasingly operate as broader malware-enablement services. Their offerings often combine payload wrapping, in-memory execution, anti-analysis checks, process injection, persistence options, delivery packaging, and post-detection “cleaning� or re-crypting services.
Insikt Group analyzed 24 threat actors advertising crypting services and products within the past year and identified a market that is competitive, reputation-driven, and heavily focused on Windows payloads. Providers advertise through underground forums, restricted communities, chat platforms, clearnet sites, and social media accounts. They compete through tiered pricing, antivirus (AV) detection scores of crypted samples, discounts, malware-developer partnerships, private or shared stubs, and promised turnaround times for re-crypting detected payloads.
Advertised crypter capabilities vary by provider, but the underlying objectives are consistent: reduce detection, delay or prevent analysis, and support stealthier payload execution. Because crypted payloads are designed to defeat both static and dynamic analysis, defenders should prioritize behavioral detection over static indicators. See the Outlook and Mitigations section for details.
Key Findings
- AV and endpoint detection and response (EDR) tools should not be treated as sufficient standalone protection against crypted payloads. Defenders should pair endpoint controls with behavioral detection, telemetry correlation, upstream hunting, suspicious process monitoring, and rapid triage of suspicious samples.
- Popular crypting service providers primarily advertise support for Windows payloads, with no identified advertising for macOS or Linux crypting services. However, although Windows environments were most frequently targeted by the services reviewed in this report, they are not inherently more susceptible to the execution of crypted payloads.
- Crypted payloads increase the likelihood of successful malware execution and delayed detection, but they do not independently provide end-to-end intrusion capability. Downstream activities, such as lateral movement, data theft, ransomware deployment, and follow-on compromise, depend on the embedded malware and the operator's objectives.
- Crypter risk varies significantly with provider maturity and technical capability: advanced crypters offer portability, anti-analysis, process injection, persistence, and security product bypass capabilities, whereas less-advanced crypters generally provide basic payload obfuscation techniques.
- Crypter capabilities are generally not novel individually, but their commercial packaging makes established defense-evasion tradecraft easier to access, reuse, and operationalize. The significance of crypters lies less in technical innovation than in making mature evasion methods available as paid services.
The Crypter Landscape
What Is a “Crypter�?
“Crypting� is what threat researchers generally refer to as a service or product wherein a file, almost exclusively a malicious executable of some kind, is encrypted to bypass malware detection technologies. The result of a crypting service is a malicious payload that modifies the supplied executable in ways that deter defenders and endpoint security solutions (namely, AV and EDR products) from detecting and analyzing it.
How Does Crypting Work?
While the core functionality of a crypting service or product is to encrypt a payload, services vary in the capabilities they provide. These capabilities can range from the encryption algorithms used, which are often proprietary, to behavioral adjustments for how the resultant payload will execute in a victim environment. For instance, many crypting services include execution guardrails or methods for indicator suppression, such as ensuring execution fails in virtual environments or performing environmental scanning before execution to determine whether the payload is running in an analysis or sandbox environment.
By using crypting services, threat actors can evade detection and prevent their malicious code from being easily exposed to researchers, an important consideration for those who wish to reuse payloads for extended periods without detection.
Who Is Selling Crypting Services?
The crypter landscape comprises a community of criminal threat actors that often operate on restricted or closed networks, including the dark web and underground forums, to market and sell their crypting services. Threat actors may also opt to market their services on clearnet websites they own and operate. In some instances, threat actors may be accessible only via messaging platforms, such as Telegram or TOX, which likely mask their exposure and reduce the likelihood of sensitive data leaking through forum chats. Finally, some threat actors have created social media accounts where they post updates on their services, partnerships, pricing, and links through which interested buyers can inquire about purchases.
Additionally, partnerships between malware developers and crypting service providers are not uncommon. For instance, a well-established crypting service provider on underground forums, “GoldenCrypt�, is reportedly affiliated (1, 2, 3) with multiple malware families, including FvncBot, Albiriox, and Mirax. The level of affiliation between a crypting service provider and a malware developer can range widely, from providers with loose reputational ties to developers who are mainly affiliated with one hacking group and will opportunistically provide services to third parties. However, these partnerships are often a marketing strategy that crypting service providers use to secure kickbacks and boost positive reputational sentiment.
All of these services come at widely varying costs, typically based on core factors. For instance, crypting service fees are often tied to the volume and types of files to be encrypted, as well as the duration of service, with almost all crypting service providers offering tiered payment options along these lines. The actual prices of these tiers are pegged to additional factors related to the provider and their product, including the reputation of the threat actor, the capabilities of their encryption service, the promise that a crypted payload is fully undetectable (FUD), and additional features provided to the buyer. Threat actors will support the assertion that their payloads are FUD by using multi-AV platforms, the most common of which is KleenScan, a service that allows threat actors to scan samples without storing and potentially exposing the samples to researchers. As with other legitimate services, service providers also advertise discounts and similar deals to remain competitive with their peers.
Who Is Using Crypting Services?
Many threat actors have been observed in the wild using crypting services due to their stealth capabilities. All malware types can be crypted, and the key factors determining whether a threat actor can use a crypting service are the targeted device’s operating system and the payload’s programming language. For instance, the most common crypting services are geared toward Windows .exe and .dll payloads. Still, considerations such as whether a payload is coded in .NET, C, or C++ can provide additional capabilities for crypted payloads or, in other instances, prevent certain payloads from being crypted.
While the use of crypting services is common among threat actors, it is by no means ubiquitous. Due to sometimes prohibitive pricing strategies and an environment that often relies on reputational checks before purchase, crypting services are often used only by well-established criminal threat actors or larger threat actor groups that have their own specialist or custom tooling for crypting payloads. Furthermore, as discussed previously in this report, not all crypting services support all types of payloads. While this does not expressly ensure that a payload cannot be crypted, threat actors seeking to crypt more unique types of executables may find their options limited or even nonexistent.
Nevertheless, crypting services are commonly marketed by threat actors and are commonly implemented by professional threat actor groups. Multiple open-source reports on high-impact cyberattack campaigns have supported this. For instance, in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impacted a public US accounting firm in May 2025.
Crypting Service Characteristics
Insikt Group investigated 24 crypting service or product providers active within the past year and identified the various capabilities advertised by each. This information helped determine the capabilities most commonly displayed by crypting services, products, and the payloads they create, and provided insight into the capabilities most desirable to customers buying these services and products. A heat map of the techniques advertised by these threat actors is shown in Figure 1, below. (The list of MITRE ATT&CK techniques shown in Figure 1 can also be found in Appendix B.)
Source: RecordedFuture
Source Link: https://www.recordedfuture.com/research/malware-crypting-services-threat-actors