Recorded Future’s Insikt Group published a useful look at the market for malware “crypting” services: paid offerings that modify malicious payloads so they are harder for antivirus, EDR, sandboxes, and analysts to detect or unpack. The important point for defenders is not that crypting is new. It is that evasion tradecraft has become a product category.

Insikt Group analyzed 24 threat actors advertising crypting services and found a competitive market built around Windows payload support, claims of low detection rates, private or shared stubs, rapid “re-crypting” after detections, anti-analysis checks, in-memory execution, process injection, persistence options, and packaging that helps less mature operators reuse mature defense-evasion techniques.

That matters for small businesses, managed service providers, and government contractors because it lowers the skill floor for malware operations. A phishing crew, access broker, or ransomware affiliate does not need to invent loader tradecraft from scratch. They can buy a wrapper, test against scanning services, refresh the build when detections rise, and keep pushing the same underlying payload into new environments.

What crypting services change

Traditional malware defense often starts with the file: hash reputation, static signatures, suspicious strings, packer traits, and known indicators. Those controls still matter, but crypting services are designed specifically to weaken that first layer. A crypted payload may look different every build while preserving the same operator intent: execute, evade, persist, steal, move laterally, or stage ransomware.

The practical shift is that defenders should expect commodity malware to arrive with capabilities once associated with more capable crews. Basic obfuscation may be paired with sandbox checks, delayed execution, encrypted strings, in-memory payload handling, parent-process tricks, or injection into legitimate processes. None of those techniques are magical by themselves, but packaging them into a service makes them easier to operationalize repeatedly.

Why “clean” scans are not enough

One of the more dangerous habits in SMB environments is treating a low-detection file scan as a decision point: if the file is not widely flagged, it must be safe enough. Crypting services exist to exploit exactly that assumption. Underground providers advertise detection scores and “fully undetectable” builds because buyers want payloads that survive the first scan, the first sandbox, and the first helpdesk review.

For defenders, the answer is not to abandon endpoint security. The answer is to stop treating endpoint prevention as the whole control stack. Static and reputation-based blocking should be paired with behavior-focused telemetry: suspicious process trees, unusual script interpreters, unexpected child processes from Office/PDF/browser/email clients, credential-access patterns, archive extraction followed by execution, network beacons, privilege-escalation attempts, and persistence creation.

Defensive takeaways

  • Hunt behavior, not just hashes. Build detections around execution chains and tactics: script-to-binary staging, process injection, LOLBin abuse, unusual service creation, scheduled tasks, startup-folder writes, credential dumping, and outbound C2-like patterns.
  • Correlate endpoint and identity telemetry. A crypted loader is only the start. Watch for the follow-on: new OAuth grants, abnormal MFA prompts, impossible travel, mailbox rule creation, token theft, VPN logins from unusual infrastructure, and admin tool use from non-admin workstations.
  • Reduce execution paths. Application control, macro restrictions, script control, browser download controls, attachment sandboxing, and least-privilege workstations make crypted payloads work harder.
  • Instrument your “boring” Windows estate. Sysmon or equivalent EDR telemetry, PowerShell logging, command-line capture, DNS logs, and proxy logs are what turn a suspicious event into an investigation instead of a guess.
  • Make sample triage fast. If a file looks suspicious but scans clean, preserve it, collect endpoint context, and review behavior. A clean first scan should trigger caution, not relief, when the delivery chain is suspicious.
  • Pressure-test incident response. Assume an initial payload may bypass prevention. The real question is whether the organization can detect staging, lateral movement, credential theft, and ransomware preparation before impact.

Bulwark Black assessment

Crypting services are best understood as malware enablement infrastructure. They do not create intrusion capability by themselves, but they make evasion cheaper, repeatable, and available to more actors. That means the defender’s advantage has to move closer to behavior, identity, segmentation, and response speed.

For government contractors and regulated SMBs, this is also a compliance reality. If your security program depends on “we have antivirus” as the primary answer, crypted payloads are exactly the threat model that breaks that assumption. Endpoint tools should be part of a layered program that includes logging, alert review, privileged access control, phishing-resistant authentication, recoverable backups, and practiced incident response.

The bottom line: expect malware to be repackaged. Build controls that recognize what the payload does after it runs.

Source: Recorded Future / Insikt Group — Malware Crypting Services and the Threat Actors Who Sell Them