Underground Market for Malware Crypting Services Grows

• •24 threat actors are actively selling malware crypting services on underground forums.
• •ImComplexed's loader disguises itself as Hyper-V Manager to evade detection.
• •Defenders are advised to prioritize behavior-based detection over static signatures.

An analysis by Insikt Group reveals a competitive market for malware crypting services, with 24 threat actors identified selling products designed to bypass detection by antivirus and endpoint detection tools. These services offer capabilities such as payload obfuscation, in-memory execution, and rapid re-crypting, allowing attackers to evade security measures effectively. The report highlights vendor ImComplexed, which uses a sophisticated multi-stage loader disguised as Hyper-V Manager to execute malicious payloads stealthily. Pricing for these services varies significantly, with basic crypts starting at $30 and premium packages reaching up to $20,000. The rapid evolution of these crypting techniques poses a significant challenge for cybersecurity defenses, necessitating a shift towards behavior-based detection strategies. Current recommendations emphasize monitoring for process injection and suspicious child-process chains to counteract these threats.