Rapuncel & Alinubx.sys: When a Microsoft-Signed Driver Becomes a Weapon Against 145 Security Products

Overview

On September 17, 2026, the LastPass TIME team and Delphos Labs jointly published an analysis of an industrial-scale malware distribution campaign in which LastPass Authenticator was merely one of more than 40 brands impersonated by the same kit.

The attack chain has three principal components:

Distribution infrastructure — counterfeit GitHub repositories, SEO-optimized, routing victims through multiple hidden redirect layers before reaching the actual payload server.
Rapuncel — an infostealer harvesting passwords from 19+ browsers, cryptocurrency wallets from 30+ applications, Discord/Steam/Telegram sessions, and the entire contents of Windows Credential Manager.
Alinubx.sys — a kernel driver bearing a valid Microsoft signature, containing a list of 145 security product process names that it terminates from kernel level — that is, from a position where EDR/AV cannot defend themselves.

The most concerning aspect is not the technique, but the trust signals it neutralizes. At the time of analysis (August 20, 2026), the Alinubx.sys driver had:

0/72 detections on VirusTotal — a figure unchanged since July 2025
A valid Microsoft Windows Hardware Compatibility Publisher signature, timestamped March 2023
No presence in Microsoft's vulnerable driver blocklist (DriverPolicy_Enforced.xml)

Put differently: a careful user — downloading from GitHub, verifying the digital signature, scanning on VirusTotal, trusting Microsoft's blocklist — still gets through all four defensive layers compromised.

About the Threat Actor

Attribute	Detail
Stealer name	Rapuncel (named by Delphos Labs)
Kernel driver name	Alinubx.sys (an identity-swapped variant of CcProtect.sys)
Active period	At least early 2026 → September 2026; infrastructure shows "every sign of continuing"
Discovery milestones	LastPass TIME identified the fraudulent GitHub organization on August 13, 2026; investigation snapshot dated September 10, 2026
Operating model	Malware-as-a-Service (MaaS) — one kit, more than 40 brands impersonated
Packing tool	Cruciferra crypter (PUROSANGUE package) — Delphos assesses this at high confidence
Relationship to known families	BoryptGrab — Delphos assesses Rapuncel as a variant or sibling build at moderate confidence; not a byte-for-byte match to any sample Trend Micro has published
Attribution	No attribution to any specific group. This is the commercial cybercrime ecosystem, not a targeted APT campaign

On the MaaS model: The primary payload server albinofennel.com was confirmed to be serving at least 40 other branded impersonation lure pages concurrently. The kit uses a JavaScript component (window.__PM__) to automatically generate lure pages per brand — meaning expansion to brand 41 or 42 costs the operator essentially nothing. LastPass was not singled out; it was one brand in a catalogue.

A note on origin: Delphos found no definitive evidence that Rapuncel was AI-generated, though "an AI-assisted rewrite from the same specification cannot be ruled out; a human rewrite is equally plausible." This is commendably restrained phrasing at a time when many reports attribute work to AI far too readily.

Technical Analysis

1. Distribution Infrastructure — Four Layers of Concealment

1.1. Counterfeit GitHub repositories

Two accounts were identified:

Account	Characteristics
`github.com/LastPass-Authenticator`	Used genuine LastPass logos, branding and product descriptions; featured a prominent "GET – LASTPASS AUTHENTICATOR" call-to-action; deliberately SEO-optimized to rank highly in search results
`github.com/LastPass-S`	Nearly identical SEO-stuffed language promoting a "macOS LastPass" product; removed before the investigation concluded

Analysts assess it is "likely the same actor running multiple impersonation accounts."

Why GitHub? Because the github.com domain is itself a trust signal. Users — including technically literate ones — routinely treat a GitHub link as software's official distribution channel. That is precisely the assumption being exploited.

1.2. The multi-layer redirect chain

Search result ("lastpass authenticator download")
   │
   ├─→ github.com/LastPass-Authenticator  (fake repo, high SEO rank)
   │
   ├─→ lastpass-authenticator.github.io   (fake download portal)
   │      └─ displays fabricated trust badges: "VirusTotal Approved",
   │         "Secure Archive", "Authorized Access"
   │
   ├─→ edgarcostartqd.github.io           (HIDDEN waypoint)
   ├─→ dallikilic54.github.io             (HIDDEN waypoint)
   │      └─ custom 404.html files containing JavaScript
   │         for silent forwarding
   │
   ├─→ istatlmenus.com/mandua.wonted      (dynamic director, Cloudflare-fronted)
   │      └─ supplies payload server addresses at RUNTIME
   │
   └─→ albinofennel.com / hanselarinmusky.com   (payload servers)
          └─ deliver ZIP archives with embedded user tracking codes

Two design details worth noting:

First — the fabricated trust badges. The fake download page displays "VirusTotal Approved" and "Secure Archive" labels. This is social engineering aimed precisely at security-conscious users — people who know what VirusTotal is and will relax when they see that label. To someone unfamiliar with VirusTotal the badge is meaningless; to someone familiar, their own knowledge is turned against them.

Second — the dynamic director layer. The endpoint istatlmenus.com/mandua.wonted supplies payload server addresses at runtime, enabling infrastructure rotation without modifying the lure pages. When a payload server is blocked, the operator updates one place; the entire repository and GitHub Pages apparatus remains intact and keeps working.

Two domains, macperformancetools.com and zaffersnouty.com, serve as terminal redirects, 302-ing to innocent sites (awwwards.com and threads.com) — muddying automated analysis.

1.3. The oversized-ZIP tactic to defeat scanners

Filename	Size
`LastPass-Authenticator-download-1.66.2.zip`	148 MB
`lastpass-authenticator-2.78.7.zip`	127.9 MB

That size is not from actual content. The archives are padded with two junk files purely to inflate volume:

TitanStorage.dll   (padding only)
ProManager.dll     (padding only)

The purpose: to exceed the file-size limits of automated scanning tools. Many sandboxes, email gateways and online scanning services have a maximum size threshold — files over the threshold are passed through unscanned, not blocked. This is exploitation of a "fail-open" design decision in defensive tooling.

Delphos notes the technique matches their own earlier research on a libpsl-5.dll stealer sample weighing 55 MB, most of which was junk padding.

2. The Loader — DLL Side-Loading via Microsoft's Own Debugger

The executable component inside the archive is vsdbg.exe — Microsoft's genuine debugger, renamed to look like a LastPass installer. Windows automatically loads the companion file vsdbg.dll from the same directory — this is standard Windows behavior, deliberately exploited. The vsdbg.dll in the archive is not Microsoft's library but the attacker's code.

Loader attribute	Detail
SHA-256	`ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6`
Runtime	.NET NativeAOT — not Mono or standard .NET, chosen to harden against IL decompilation
Payload container	The `.reloc` section, encoded with a custom Base16 alphabet (bytes `0x50`–`0x5F`, corresponding to `PQRSTUVWXYZ[\]^_`)
Build environment string	`C:\ExploitTests\purosangue.tx` (recovered through decryption)

The purosangue string is the single strongest piece of evidence linking this sample to Cruciferra crypter's PUROSANGUE package — detailed in the attribution section.

On the NativeAOT choice: this is a deliberate upgrade. Proofpoint previously documented Cruciferra using the Mono runtime; NativeAOT compiles straight to native code, rendering conventional .NET decompilers (dnSpy, ILSpy) ineffective. The operator is actively making life harder for analysts, not just for AV.

3. Privilege Escalation — Three Methods

The loader attempts three escalation techniques in sequence, of which one is explicitly named:

UAC bypass via COM Elevation Moniker — exploiting a built-in Windows feature that lets programs request elevated permissions.
and 3. Two additional methods; the original report does not name them specifically, describing them only as attempted exploitation of "built-in Windows features."

On success, the malware attains SYSTEM privileges — above a standard administrator account, and a prerequisite for installing the kernel driver in the next stage.

Note on completeness: The original report names only one of the three escalation methods. We preserve that level of detail rather than speculating about the other two.

4. Alinubx.sys — The Kernel Driver at the Center of the Campaign

This is the component most worth analyzing, because it demonstrates an attack model that no patch can close.

4.1. Origin: a legitimate security product with its identity swapped

Alinubx.sys is not newly written. It is an identity-swapped build of CcProtect.sys — the driver belonging to the CnCrypt disk encryption and host defense product from the Chinese company Henan Dafeng Software Co., Ltd. — a legitimate commercial product.

Version resource field	Known CcProtect.sys	Alinubx.sys
Product	CnCrypt	CnCrypt (unchanged)
Version	1.32	1.32 (unchanged)
Description	CnCrypt Protect Driver	Alinubx Driver (altered)
Original filename	CcProtect.sys	Alinubx.sys (altered)
Submitter	Henan Dafeng Software Co., Ltd.	Henan Dafeng Software Co., Ltd. (unchanged)

The original report captures the essence precisely: "The functionality stayed recognizable, while the identity changed enough for detection to miss it."

The core point to understand correctly: the attacker did not break Microsoft's signature, nor compromise Henan Dafeng. They merely altered a few metadata fields on a driver Microsoft had already validly signed back in March 2023 — and the signature remains valid, because a signature attests that this file passed a certification process at that time, not that the file is safe when repurposed.

More notable still: public proof-of-concept code already existed — BlackSnufkin's CcProtect-Killer repository on GitHub had documented exactly this process-kill primitive. Meaning this capability required no new research; it was already sitting on the internet.

4.2. Detection status — four layers of trust failing together

Defensive layer	Status (August 20, 2026)
VirusTotal	0/72 detections — unchanged since July 2025
Digital signature	Valid — Microsoft Windows Hardware Compatibility Publisher chain, timestamped March 2023
Microsoft vulnerable driver blocklist	Not present in `DriverPolicy_Enforced.xml`
Publisher identity	A real, legitimate company name

SHA-256: 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61

4.3. Capabilities active in this campaign

Kernel-level security process termination — the specific mechanism:

The driver opens a handle to the target process with the KernelMode access flag, which:

Bypasses user-mode SeAccessCheck — normal permission checks are not applied
Defeats Protected Process Light (PPL) without touching bits in the EPROCESS structure
Terminates the process via ZwTerminateProcess

This is the architecturally concerning part: PPL is the Windows mechanism intended to protect EDR/AV processes from being killed. A driver running in kernel with a KernelMode handle operates above the layer PPL protects — so the mechanism ceases to matter.

Control interface:

Device name:  \\.\Alinubx
IOCTL:        0x222024   (accepts target process IDs)

The 145 security process names: The function sub_1800eae00 allocates 0x91 = 145 entries, then fills them with decrypted EDR/AV process-name strings. The list covers antivirus suites, endpoint security platforms and behavioral analysis tools from major defensive vendors.

Persistence:

Installed as a Windows service named NvFsFilter, auto-starting at boot
Runs a continuous loop, checking which security products have restarted in order to kill them again
The driver file is named nvfsflt64.sys, masquerading as an "NVIDIA File System Filter Driver"

The continuous loop matters for incident responders: restarting the AV service does not solve the problem — the driver will kill it again. Resolution requires removing the driver first, and that cannot be done safely while the system is running.

4.4. Capabilities present in code but NOT configured

This is the part most worth watching for future development. The driver already contains the following capabilities, but the operator has not activated them:

Capability	Activation requirement
File and registry hiding (rootkit)	Requires the config file `\SystemRoot\Alinubx.ccf` — not supplied by the operator
Process, driver and DLL interception	Requires rule configuration
Network control and WFP-based traffic redirection	Requires rule configuration
APC-based usermode DLL injection	The `ProtectR3.dll` component is present but not deployed
JSON heartbeat over HTTP POST	No URL configured

How to read this correctly: the current campaign uses the driver only as an AV-killing tool. But the full rootkit and AiTM capability already resides in the binary, awaiting one configuration file. That means: the presence of \SystemRoot\Alinubx.ccf on a system indicates broader rootkit activity, not merely AV killing — and that makes it an unusually valuable hunting indicator.

5. Rapuncel — The Scope of Data Theft

SHA-256: aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd

Data type	Detail
Browser passwords	19+ web browsers
Cryptocurrency wallets	Wallet files from 30+ applications
Discord sessions	Login tokens
Steam sessions	Session tokens — if Steam is not running, the stealer launches it, then memory-scans for credentials
Telegram sessions	Session data
Windows Credential Manager	Network passwords, Windows Hello data
Documents	Files whose names contain: `password`, `seed`, `wallet`, `recovery`
Screenshots	From all connected monitors
System information	Detailed profile

Exfiltration method:

Compresses everything into a ZIP archive
Uploads to 2.26.126.50 over raw TCP with HTTP POST framing (POST /upload)
Retries three times at 2-second intervals on failure

Persistence: installed as an auto-starting Windows service, running a continuous loop that re-runs the stealer component.

The Steam detail deserves emphasis: launching Steam if it is closed, then scanning process memory shows a high degree of initiative. The stealer does not merely read files that happen to exist — it creates the conditions needed to obtain the data.

6. Defeating Chrome's App-Bound Encryption

Google introduced app-bound encryption in 2024 with the specific purpose of preventing this exact attack — requiring that decryption of Chrome-stored passwords originate from the Chrome process itself.

How Rapuncel gets around it:

The malware injects a small piece of code directly into the browser process. That code impersonates the browser itself and calls Chrome's own password-decryption service from inside Chrome — the protection is defeated because the decryption request appears to come from a legitimate source.

Helper DLL attribute	Detail
SHA-256	`75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40`
Technique	Reflective injection into Chrome/Edge processes
Method invoked	The Elevation Service's `DecryptData` method
Size	136 KB (versus 1.35 MB for BoryptGrab's equivalent DLL)

A useful forensic artifact: this process leaves behind %TEMP%\browser_decryption.log.

An observation on app-bound encryption: the mechanism retains real value — it forces the attacker to escalate from "reading a file" to "injecting into a process," a harder step and considerably easier for EDR to catch. The problem in this campaign is that EDR had already been killed by the kernel driver. This is a clear illustration of how defensive layers depend on one another: when the lower layer collapses, the upper layer loses effect despite having no flaw of its own.

7. Attribution — Two Links at Two Confidence Levels

7.1. Cruciferra crypter (PUROSANGUE package) — HIGH confidence

Delphos assesses with high confidence that the vsdbg.dll sample was produced by Cruciferra's PUROSANGUE package or a close derivative:

Evidence	Degree of specificity
Payload stored in the `.reloc` section	Characteristic technique
Custom Base16 alphabet `PQRSTUVWXYZ[\]^_`	Highly characteristic
Build environment string `C:\ExploitTests\purosangue.tx`	The strongest evidence
Matching feature set: DLL side-loading, UAC bypass, persistence, BYOVD	Architectural match
eSentire documented PUROSANGUE producing exactly 145 default AV/EDR targets	Exact numerical match
NativeAOT runtime	An upgrade from the Mono runtime Proofpoint previously observed

The number 145 is the most striking detail: it is not this actor's own research output, but the default list of a paid commercial tool. Which means every Cruciferra customer has the capability to kill 145 security products — the technical barrier here has been commercialized down to nearly nothing.

7.2. BoryptGrab — MODERATE confidence

Delphos assesses Rapuncel as a BoryptGrab-related variant or sibling build (Trend Micro documented BoryptGrab in March 2026), at moderate confidence — "not a confirmed match to any of Trend Micro's published samples, but the behavioral and artifact-level overlap is sufficient to place it within the BoryptGrab ecosystem."

Confirmed overlaps:

A shared lure brand: passathook-cs2 appears in both investigations
Delivery architecture: SEO-optimized GitHub repos → .github.io portals
The dynamic intermediate URL pattern
Collection artifacts: UserInformation.txt with a BUILD NAME field, installed_applications.txt, and the misspelled Filegraber directory (a highly distinctive tell)
The same target set: Telegram, Discord, Steam, crypto wallets, browser credentials
The same app-bound encryption bypass via a dedicated helper DLL
The same ZIP size-inflation tactic

Differences:

Payloads are not byte-identical; different build names (Rapuncel vs. CryptoByte/Shrek/Sonic/Yaropolk)
The browser helper DLL differs in implementation (136 KB vs. 1.35 MB, different encryption and exports)
Separate C2 infrastructure (2.26.126.50 vs. the servers Trend Micro documented)
Rapuncel deploys a kernel driver; BoryptGrab was documented with a reverse SSH backdoor (TunnesshClient) and a Golang downloader (HeaconLoad)
Rapuncel uses the window.__PM__ JavaScript kit to automatically generate lures for 40+ brands; BoryptGrab lacks this automation

Risk Summary

Risk Dimension	Level	Rationale
Ability to neutralize defenses	Critical	Kills 145 security products from kernel level, defeating even Protected Process Light; the continuous loop means restarting AV has no effect
Likelihood of prior detection	Very Low	0/72 on VirusTotal for over a year; valid Microsoft signature; absent from the blocklist
Data loss severity if infected	Critical	All browser passwords, crypto wallets, sessions, Credential Manager and Windows Hello data — all collected before AV is killed
Remediation difficulty	High	The driver operates below user-mode tooling; it cannot be removed safely while the system is running — requires Safe Mode or external recovery tools
Campaign scalability	High	MaaS model, 40+ brands impersonated, automated lure generation, a director layer enabling infrastructure rotation without touching lures
Capability escalation potential	High	Rootkit, APC injection and WFP traffic redirection already in the code, awaiting a configuration file
Patch-based risk reduction	Not applicable	There is no patch to wait for — this is a legitimate driver being abused, not a vulnerability

A note on one particular row above: "Patch-based risk reduction: Not applicable" is not good news — it means no vendor action can end this risk. The only measures are blocking the driver (via Microsoft's blocklist or an internal WDAC policy) and behavioral monitoring.

IOCs & Artifacts

File Hashes (SHA-256)

Component	Hash
`vsdbg.dll` (.NET NativeAOT loader)	`ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6`
Rapuncel stealer	`aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd`
Alinubx.sys (kernel driver)	`611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61`
Browser injection DLL	`75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40`
`ProtectR3.dll` x64 (unpacked)	`26db14b956e33f69b3397a36387d32e01eb63613acff91069dc76b6ed7de45a8`
`CcProtect.sys` v1.32 (reference sample)	`5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c`

Domains

Domain	Role
`albinofennel.com`	Primary MaaS payload server — hosted 40+ branded lure pages
`hanselarinmusky.com`	Secondary payload server
`icansamyope.com`	Tertiary payload server
`istatlmenus.com`	C2 director layer (Cloudflare-fronted), endpoint `/mandua.wonted`
`macperformancetools.com`	Terminal redirect (302 to an innocent site)
`zaffersnouty.com`	Terminal redirect (302 to an innocent site)
`ryanpresbrey.cc`	Favicon cluster (relationship undetermined)
`lastpass-authenticator.github.io`	Fake download portal
`edgarcostartqd.github.io`	Hidden waypoint (404.html containing JS)
`dallikilic54.github.io`	Hidden waypoint (404.html containing JS)
`github.com/LastPass-Authenticator`	Primary impersonation repository
`github.com/LastPass-S`	Secondary impersonation repository (removed)

IP Addresses

IP	Role
`2.26.126.50`	Rapuncel exfiltration endpoint (raw TCP, `POST /upload`)
`104.21.27.38`	Cloudflare proxy for `albinofennel.com`
`172.67.168.224`	Cloudflare proxy for `albinofennel.com`
`172.67.212.253`	Cloudflare proxy for `istatlmenus.com`
`104.21.20.224`	Cloudflare proxy for `macperformancetools.com`
`104.21.18.89`	Cloudflare proxy for `zaffersnouty.com`

File Paths

C:\Windows\System32\drivers\nvfsflt64.sys   ← driver installation point (NVIDIA masquerade)
%TEMP%\browser_decryption.log               ← browser password decryption artifact
%TEMP%\sends.log                            ← exfiltration confirmation
\SystemRoot\Alinubx.ccf                     ← ⚠ rootkit configuration: if PRESENT,
                                              rootkit capability has been activated,
                                              not merely AV killing

Service & Device Names

NvFsFilter      ← Windows service name (NVIDIA component masquerade)
\\.\Alinubx     ← driver IOCTL device
IOCTL 0x222024  ← command accepting process IDs to terminate

Registry

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
   → DELETED (breaking Chrome extension integrity)
   → confirmed at BOTH terminal redirect destinations, indicating deliberate capability

Additional Pivot Indicators

Publisher (Authenticode OpusInfo programName):  Henan Dafeng Software Co., Ltd.
Favicon dhash:   3761dd64e0d46913
Body SHA-256:    1e6c1766ac78d7adfdae71d361cb132d972771897ae9065503b135cb812d7c35
                 (redirect JavaScript at istatlmenus.com/mandua.wonted,
                  confirmed live September 10, 2026)

MITRE ATT&CK Mapping

Confirmed active in this campaign

Tactic	ID	Technique	Manifestation
Defense Evasion / Persistence	T1574.002	Hijack Execution Flow: DLL Side-Loading	Microsoft's `vsdbg.exe` loading malicious `vsdbg.dll`
Defense Evasion	T1553.002	Subvert Trust Controls: Code Signing	Driver with a valid Microsoft WHCP signature from March 2023
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools	145 AV/EDR processes killed from kernel
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name or Location	`nvfsflt64.sys` / service `NvFsFilter` masquerading as NVIDIA
Privilege Escalation	T1548.002	Abuse Elevation Control Mechanism: Bypass UAC	COM Elevation Moniker plus two other methods
Persistence	T1543.003	Create or Modify System Process: Windows Service	Auto-start services for both driver and stealer
Execution	T1055.012	Process Injection: Process Hollowing	—
Credential Access	T1555.003	Credentials from Web Browsers	19+ browsers; defeats app-bound encryption
Credential Access	T1539	Steal Web Session Cookie	Discord, Steam, Telegram sessions
Collection	T1113	Screen Capture	Screenshots from all monitors
Collection	T1005	Data from Local System	Files containing `password`, `seed`, `wallet`, `recovery`
Exfiltration	T1041	Exfiltration Over C2 Channel	ZIP → `2.26.126.50` over raw TCP POST

Present in code but NOT configured

Tactic	ID	Technique	Activation requirement
Defense Evasion	T1014	Rootkit	Requires `\SystemRoot\Alinubx.ccf`
Execution	T1055.004	Process Injection: Asynchronous Procedure Call	Requires `ProtectR3.dll` deployment
Collection / C2	T1557	Adversary-in-the-Middle	Requires WFP redirect configuration

Expert Assessment

The biggest lesson from this campaign concerns the nature of "trust signals." The original report makes it explicit: the campaign exploited four independent assumptions, and all four failed:

A familiar brand on GitHub = the official channel → a counterfeit, SEO-optimized repository
A Microsoft signature = a vetted driver → a valid signature, but for a product with an entirely different purpose
Clean on VirusTotal = a safe file → 0/72 for over a year
Covered by the blocklist = protected → the driver was not in the blocklist

What is worth reflecting on is that all four assumptions are reasonable in the vast majority of cases. They are not misinformation — they are high-probability heuristics, and that is precisely what makes them worth attacking. The attacker broke no mechanism; they found the gap between what a signal actually attests to and what users understand it to attest to. A Microsoft signature attests that this file once passed a certification process — it never attests that this file is safe in every context of use.

On DLL side-loading: this is the fourth instance in this series. SLEEPWALKER (via ESET), MoiClient (via SumatraPDF), BambooToken (via Tendyron OnKey), and now Rapuncel (via Microsoft's own vsdbg.exe). Four independent campaigns, four different vendors, one shared underlying mechanism: the Windows DLL search order. This degree of recurrence confirms what earlier articles argued — this is not any vendor's bug, but a systemic attack surface of the platform. Security teams should treat "monitor DLL loading from the application directory of third-party software" as a standing control, not a response to individual incidents.

On BYOVD: the technical barrier has been commercialized. The most concerning detail in the entire report, in our assessment, is not the driver's capability — it is that the number 145 is the default list of a paid crypter. Which means: no kernel-research expertise is required to gain the ability to kill 145 security products — only a purchase. Combined with the fact that proof-of-concept code for CcProtect.sys was already public on GitHub, the whole capability chain has been turned into a commodity. BYOVD was once a technique for well-resourced groups; now it is a product feature.

On layered defense — an observation that gets too little attention. Chrome's app-bound encryption is a well-designed mechanism that retains real value: it forces the attacker from "reading a file" to "injecting into a process," behavior that is far noisier and far easier for EDR to catch. Yet in this campaign it was ineffective, not because of any flaw in it, but because EDR had already been killed. This is the clearest illustration of something security teams should weigh when designing architecture: many defensive layers that appear independent in fact rest on a shared layer underneath. As kernel-level EDR-killing capability becomes as widely available as it now is, these hidden dependencies need re-examination.

On the dead code — read it as a forecast. That rootkit functionality, APC injection and WFP traffic redirection exist in the binary but are unconfigured shows the operator is holding capability in reserve. The current campaign only needs AV killed so the stealer can work; but the same driver, given one .ccf file, becomes a full rootkit. This is also why the \SystemRoot\Alinubx.ccf indicator deserves high hunting priority: its presence distinguishes "a stealer infection" from "a rootkitted system" — two materially different severity levels.

For Vietnam, the caveat comes first: the original report publishes no victim data by country, so there is no confirmation of victims in Vietnam. That said, three features of the domestic context make this attack model worth more than average attention:

First — the habit of downloading software from search results. This campaign depends entirely on SEO: victims come to it themselves, with no phishing email and no vulnerability exploitation required. Given how common it is to type a software name into Google and download from the first plausible-looking result, this model has a high success rate. More importantly: because the lures impersonate more than 40 brands, this cannot be defended against by "being careful about LastPass" — it needs a general rule that software is downloaded only from the developer's official domain.

Second — cryptocurrency ownership rates. Vietnam has for years ranked among the world leaders in the proportion of its population holding crypto assets. Rapuncel targets wallets from 30+ applications and files whose names contain seed, wallet, recovery — which includes seed phrases stored as text files, still a common habit. The loss here is irreversible: unlike a password that can be changed, a wallet whose seed phrase has been stolen is gone permanently.

Third — limited familiarity with security brand identities. Users in Vietnam are often less familiar with international password-manager brands, making it harder to distinguish an official site from a counterfeit by instinct. Meanwhile, the "VirusTotal Approved" badge trap targets precisely the partially security-aware — people who know what VirusTotal is but have not yet learned that the label can be fabricated at will on any web page.

An additional recommendation for organizations in Vietnam: because this driver is not in Microsoft's blocklist as of publication, the most proactive measure is to block it at the organization level — adding hash 611b3ba6... and the Henan Dafeng / CnCrypt indicators to an internal WDAC or App Control policy, rather than waiting for a Microsoft update. This is actionable immediately and depends on no vendor.

Recommendations

For systems suspected of infection — urgent

Treat every credential as exposed. Browser passwords, cryptocurrency wallets, Discord/Steam/Telegram sessions and Windows Credential Manager contents were collected BEFORE antivirus was killed — so the fact that AV is still running normally does not mean the system is safe.
Change passwords from a separate clean machine. Never from the affected machine itself — keylogging and stealer components may still be active.
Give cryptocurrency wallets top priority: move assets to new wallets with new seed phrases. A seed phrase that has been read cannot be "password-changed."
Revoke sessions, not just passwords. Stolen Discord/Steam/Telegram tokens remain usable after a password change — every device must be signed out.
Review password vault activity for unexpected access or changes.
Kernel-level forensics is required. Alinubx.sys operates below user-mode tooling; ordinary Windows utilities cannot remove it safely while the system is running. This requires booting into Safe Mode or using external recovery tools. In an enterprise environment, the safest course is reinstalling the operating system.

Blocking and controls — short term

Add the driver hashes to an internal WDAC / App Control policy — do not wait for Microsoft to update the blocklist:

611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61   (Alinubx.sys)
5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c   (CcProtect.sys)

Block by publisher identity: reject drivers whose Authenticode programName contains "Henan Dafeng" or whose version resources reference "CnCrypt", if the organization does not use that product.
Enable Microsoft's vulnerable driver blocklist (DriverPolicy_Enforced.xml) if not already on — this driver is absent from it, but the blocklist still stops hundreds of other BYOVD drivers.
Block the domains at DNS/proxy: albinofennel.com, hanselarinmusky.com, icansamyope.com, istatlmenus.com, macperformancetools.com, zaffersnouty.com.
On 2.26.126.50: do not block mechanically. Per Delphos's recommendation, use it as shared-infrastructure context and act only with corroborating request framing (POST /upload over raw TCP carrying a ZIP).

Hunting — by behavior, not by hash

This is the most important section, because the original report stresses that once indicators are discovered, the operator will redeploy to fresh infrastructure, recompile with a new signature, and swap the driver filename again (as they already did from CcProtect.sys to Alinubx.sys). The durable indicators are behavioral.

Hunting for the driver:

□ Drivers whose Authenticode programName contains "Henan Dafeng"
□ Version resources referencing "CnCrypt"
□ OriginalFilename or strings matching: CcProtect.sys, Alinubx.sys, Alinubx,
  ProtectR3.dll, \\.\Alinubx
□ Creation of a service named "NvFsFilter"
□ File writes to C:\Windows\System32\drivers\nvfsflt64.sys
□ A driver load followed immediately by security processes terminated from kernel
□ ⚠ Presence of \SystemRoot\Alinubx.ccf → rootkit capability is activated,
  not merely AV killing. Escalate response priority.

Loader identification (highly useful and hard to evade):

□ PE files whose raw .reloc section SIGNIFICANTLY EXCEEDS the size declared
  in IMAGE_DIRECTORY_ENTRY_BASERELOC
□ That excess region containing a high concentration of bytes in 0x50–0x5F
  (the custom Base16-encoded payload)
□ vsdbg.exe spawning NON-Microsoft child processes
□ Companion DLL loading from the application directory (DLL side-loading generally)

The .reloc inflation indicator is notable because it catches the crypter's technique rather than a specific sample — meaning it remains effective against other payloads produced by the same Cruciferra package, including samples never seen before.

Endpoint artifacts:

□ %TEMP%\browser_decryption.log
□ %TEMP%\sends.log
□ Deletion of the registry key:
  HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

Network traffic:

□ ZIP uploads framed as "POST /upload HTTP/1.1" over raw TCP
□ Downloads of very large ZIP files (>100 MB) named after popular software
□ Access to *.github.io immediately after leaving a github.com page
  (the redirect-chain pattern)

Long-term controls

A clear organization-wide software download policy: software is obtained only from the developer's official domain — not from search results, and not from GitHub unless it is the developer's own verified GitHub organization. This is the single most effective control against this campaign, because it blocks at the first step and works against all 40+ impersonated brands, not just LastPass.
Review the size limits of your scanning tools. If the organization's sandbox or gateway passes files above its size threshold rather than blocking them, that is a fail-open design this campaign exploits directly. Consider blocking or quarantining oversized files instead of letting them through.
Monitor DLL loading from the application directory for all third-party software running with elevated privileges — a control whose value extends well beyond a single campaign, as the four cases cited in the assessment above show.
Do not rely solely on signature-based detection. The original report puts it plainly: "a signature merely asks whether a file matches something already discovered to be malicious" — this driver scored 0/72 for over a year. Add behavior-based detection and, for organizations with the capacity, direct binary analysis.
Migrate toward authentication a stealer cannot replay. Passwords and session tokens are both stealable; passkeys and physical security keys (FIDO2) are not — they do not exist as data that can be copied off the machine.
Do not store cryptocurrency seed phrases as files on a computer. Rapuncel searches for exactly those filenames containing seed, wallet, recovery. Seed phrases belong offline, outside any computer system.

Command Palette