Malware rarely reaches a victim in the form its author wrote it. Before distribution, it usually passes through a crypter: a tool that encrypts and obfuscates the binary so that antivirus and EDR products no longer recognise it. In underground jargon, the goal is a payload that is “FUD”, fully undetectable.
Crypters are often discussed as a purely technical problem. Our work within ENSEMBLE looks at them from another angle: as a market. In Inside Crypter-as-a-Service: An Ecosystem Analysis of the exploit.in Underground Forum, presented at WACCO, the Workshop on Attackers and Cyber-Crime Operations held with IEEE EuroS&P, we show that evasion is no longer bought as a tool. It is rented as a continuously maintained service, and that service only works because the forum around it has built its own institutions of trust.
A product that expires every day
A crypter has two parts. The builder encrypts the payload and binds it to a stub; the stub decrypts and runs it in memory on the victim’s machine. The weak point is the stub: once security vendors write a signature for it, every payload wrapped with it is “burned”.
This is what turns a tool into a service. On exploit.in, sellers promise stub renewal every 24 to 48 hours, sometimes every few hours. Buyers pay for freshness, not for code. The resulting offers look like ordinary Software-as-a-Service: subscription tiers, web panels, changelogs, customer support, and refunds or free re-crypts when a stub is detected within a warranty window.
To document this market, we studied exploit.in, one of the main Russian-language cybercrime forums, reachable on both the clear web and the dark web. From about one million posts, we extracted every crypter-related thread created between January 2020 and August 2025. The final corpus holds 491 threads, 2,949 posts and 1,058 unique users. Two thirds of the posts are in English, which functions as the commercial lingua franca of an otherwise Russian-speaking forum.
Threads were annotated with a large language model and then reviewed by human annotators. On a validation sample of 100 threads, actor-type classification reached 0.98 accuracy, and economic-model annotation reached a Cohen’s kappa of 0.96 against independent human coding.
Access was obtained through the forum’s standard paid registration, for observation only: no transaction and no interaction with members.
Five ways to sell evasion, four ways to buy it
The market is not a single product category. We identify five seller archetypes, which differ by technical depth, automation and business model:
- Structured CraaS operators run a full service stack: order panel, tiered plans, automated payment and regular stub updates. The high end reaches about $3,000 per month.
- Independent software vendors sell the capability rather than the service: a builder the buyer runs alone, or its source code. One vendor rented a builder for $600 per month, then offered the source for $2,000.
- Telegram bot operators automate everything through a bot, with near-instant delivery and little human contact. Entry prices start around $5 per crypt.
- Independent artisans crypt by hand, one payload at a time, often for $500 to $1,000 per week.
- Fraudulent or low-quality sellers fail to deliver, refuse tests or fake reviews. Experienced members believe they are the majority.
Buyers are just as varied. Malware operators running stealer, RAT or loader campaigns are the dominant profile: crypting is a recurring cost of doing business, with monthly budgets of $500 to $3,000. One-shot buyers need a single crypt and are the main victims of scammers. Tool acquirers buy source code or a turnkey business, at $1,500 to $20,000, and are tomorrow’s sellers. In-house recruiters give up on the open market and hire a crypter developer full time, for $5,000 to $15,000 per month.
Trust is the real infrastructure
Anonymous sellers, anonymous buyers and a product that cannot be verified before purchase: on paper, this market should collapse under fraud. It does not, because exploit.in has institutionalised trust.
The central norm is to trade “strictly through the guarantor”. The forum’s escrow service holds the funds, arbitrates disputes and acts as a credibility signal for unknown vendors. Moderators enforce the norm: they close suspect vendor threads and reopen them only after a security deposit, observed between $500 and $1,500, paid in Bitcoin or USDT. Buyers enforce it too, publicly calling out vendors who bypass escrow.
Reputation works as capital. Buyers refuse to deal with sellers who have no reputation or deposit, so newcomers pay to build it: introductory discounts, free crypts in exchange for public reviews, and published scan results. Warranty terms of three to seven days, with a free re-crypt if the stub is detected, mirror the service-level commitments of legitimate software companies.
Not the same market as HackForums
The only earlier study dedicated to Crypter-as-a-Service, by De La Cruz Alvarado and Pastrana, examined HackForums, an open English-language forum. There, crypters are mostly standardised products with graphical interfaces, aimed at users with little expertise, and priced from about $20 per crypt to $550 for a lifetime licence.
Exploit.in shows a wider and more professional market. Cheap .NET stubs at $15 to $60 coexist with offers claiming EDR bypass, Rust stubs with indirect system calls, and LLVM-based obfuscators. Some listings reach $8,000 to $12,000 per month for an exclusive stub. A few even target red-team engagements, hinting at a partly semi-legitimate clientele.
Governance also differs. HackForums relies mainly on vouches, free trials and forum reputation, with discreet moderation. exploit.in adds mandatory escrow, deposits and public dispute arbitration. The two forums do not seem to compete: they serve different levels of the same criminal value chain.
Why it matters for investigators
Crypters sit at a narrow point of the malware supply chain, between the people who write malware and the people who distribute it. Because a stub expires within days, every campaign depends on a steady relationship with a crypting provider. That dependency is visible: in one documented case, the configuration of the Dolphin Loader service names the EasyCrypt service as its crypting backend. Forum observation and binary analysis can therefore meet, linking samples to the services that prepared them.
Our results also suggest where disruption may bite. Earlier work on HackForums found crypter supply and demand stable even after marketplace takedowns. Removing one vendor is unlikely to matter much in a market with many substitutes. The scarce resource is trust: escrow, deposits, reputation and the brokers who hold the network together. Scam prevalence is already this market’s main weakness.
This is the approach we pursue within ENSEMBLE: combining large-scale, AI-assisted analysis of criminal forums with technical malware analysis, and reading cybercrime as an organised economy rather than a collection of tools. Next steps include comparing several forums, following seller trajectories and prices over time, and connecting forum evidence more closely to the samples seen in the wild.
Written by Jean-Yves Marion, with Mathieu Jeannot, Manon Pamar, Maira Nassau, Pierre Marty and Romain Guittienne. Université de Lorraine, CNRS, LORIA, Nancy.
REFERENCES
Jeannot, M., Marion, J.-Y., Pamar, M., Nassau, M., Marty, P., & Guittienne, R. (2026). Inside Crypter-as-a-Service: An ecosystem analysis of the exploit.in underground forum. WACCO, IEEE EuroS&P Workshops.
De La Cruz Alvarado, A., & Pastrana, S. (2024). Understanding crypter-as-a-service in a popular underground marketplace. IEEE EuroS&P Workshops, 85–90. https://ieeexplore.ieee.org/document/10628716
Akyazi, U. (2021). Measuring cybercrime as a service (CaaS) offerings in a cybercrime forum. Workshop on the Economics of Information Security (WEIS).
van Wegberg, R., et al. (2018). Plug and prey? Measuring the commoditization of cybercrime via online anonymous markets. USENIX Security Symposium, 1009–1026.
Pham, A. (2024). The abuse of ITarian RMM by Dolphin Loader. RussianPanda Research Blog. https://russianpanda.com/The-Abuse-of-ITarian-RMM-by-Dolphin-Loader
