Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025

What did we find?

In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. The driver, also known as, "DCRCVDrv.sys", is signed by South Korean IT company MocoMsys and exposes an IOCTL that allows user-mode applications to terminate processes directly from the kernel. The Cruciferra Malware-as-a-Service (MaaS) first appeared in November 2025 and is currently sold for $1200 per month for the package with EDR killing features by the user Cruciferra on underground hacking forums.

ErrTraffic is a separate MaaS product sold by a threat actor known as LenAI on underground hacking forums and provides operators with a convenient solution for deploying ClickFix lures that masquerade as Google reCAPTCHA, CloudFlare Turnstile, or a system error (BSOD). ErrTraffic leverages the Ethereum blockchain for dead-drop C2 domains for convenient maintenance of C2 addresses and is priced at $380 per month.

Initial Access

Victims land on compromised WordPress sites injected with an obfuscated ErrTraffic-generated JavaScript loader. The loader resolves its C2 domain by querying a Polygon smart contract, then sends a request to the C2 to retrieve the next stage to serve a ClickFix lure. The ClickFix lure copies a malicious PowerShell command to the victim's clipboard and instructs them to open it in PowerShell via Windows Key + X -> I, then paste and execute it.

Attack Chain

The attack chain, shown in the figure below, begins when a victim visits a compromised WordPress site containing the ErrTraffic JavaScript inject. The inject resolves a dead-drop C2 address via the Ethereum blockchain, then contacts that C2 to retrieve and dynamically load the ClickFix lure's JavaScript source code.

TRU discovered several additional PowerShell stages following the initial ClickFix command - a legitimate, Microsoft signed binary was used to side-load [T1574.001] the Cruciferra DLL (mscoree.dll), which uses process hollowing [T1055.012] to inject the Remus information stealer into the address space of the legitimate, Microsoft-signed binary ServiceModelReg.exe. Although not depicted in this diagram, when the UAC Bypass and EDR-killer features are enabled in the malware's configuration, it loads the BYOVD driver "DCRCVDrv.sys" and terminates 145 AV/EDR-related processes.

ErrTraffic Analysis

ErrTraffic is a MaaS product advertised on Russian-speaking underground hacking forums that enables operators to generate ClickFix lures targeting Windows, Linux, and macOS. The service provides operators a web-based panel with a wide array of capabilities, including social engineering templates, command generation, per-file geo and referrer filtering, campaign statistics, and a WordPress plugin generator for embedding the inject on compromised websites. The operator is responsible for uploading their chosen malware payload, e.g. Remus, and ErrTraffic handles the payload delivery.

A sales thread for the MaaS product can be seen in the figure below.

Within the ErrTraffic panel, operators are able to customize the appearance of the lure, either as a CloudFlare/Google CAPTCHA or Blue Screen of Death (BSOD) error, the name of the domain shown in the CAPTCHA page, light/dark mode, etc.

Injected ErrTraffic script in compromised WordPress sites are base64-encoded and XOR-encrypted with a single-byte key - which, once decoded, resolves command-and-control (C2) server through the Ethereum blockchain via the eth_call RPC method.

The next figure displays the plaintext following decoding from base64 / single byte XOR - JavaScript responsible for resolving the dead-drop C2 from the Polygon contract via the getDomain method. After resolving the C2 address, the script appends a new <script> element to either document.head or document.body. This element triggers a request to the C2 using the following URL format:

• <C2_ADDRESS>/api.php?s=<AUTH_KEY>&_v=<NUM_WHOLE_MINUTES_SINCE_UNIX_EPOCH>

The response from the C2 contains the ClickFix lure's JavaScript source code.

Polygon smart contracts identified in our analysis are as follows:

• 0xB6BC9E1D0B2FB96AB7C47E04CB0BE477410BC1F2
• 0x83833C5D676CA06E941A32310AE67D0890F657EE

The full list of RPC endpoints (14 in total for redundancy) are as follows:

• polygon.drpc.org
• polygon-mainnet.gateway.tatum.io
• polygon.rpc.subquery.network/public
• polygon.lava.build
• 1rpc.io/matic
• polygon-public.nodies.app
• polygon.rpc.hypersync.xyz
• rpc-mainnet.matic.quiknode.pro
• gateway.tenderly.co/public/polygon
• polygon.therpc.io
• polygon.gateway.tenderly.co
• polygon-mainnet.public.blastapi.io
• rpc.ankr.com/polygon
• polygon-bor-rpc.publicnode.com

Transaction history within the smart contract shows threat actors periodically rotating the active C2 domain, as a convenient means of rotating infrastructure without needing to update the inject script across numerous compromised websites.

Cruciferra Analysis

SHA256: 0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce

Cruciferra is a MaaS marketed on underground hacking forums as a "crypter" (malware loader) that kills EDR/AV. Over time, "stubs" payloads vary but consistently frequent the use of BYOVDs like the examples included in Proofpoint's blog, Unpacking "Cruciferra": An Analysis of a Sophisticated Crypter Service. The specific vulnerable driver abused in this payload is not currently known to Microsoft or LOLDrivers. The payload is a .NET 7.0 application compiled via NativeAOT, typically delivered through DLL side-loading. TRU assesses with high confidence that this payload was generated by an operator using the "PUROSANGUE" package, described later in this blog.

String Encryption

At the time of our analysis, there was no plugin available for Binary Ninja to extract metadata from NativeAOT-based samples. In response, we ported @vinopaljiri's NativeAOT plugin from IDA Pro to Binary Ninja. For usage and installation instructions, see our Github repository available here. Additionally, we opened pull requests to enable support for .NET 7.0 compiled plugins in @washi_dev's repository for Ghidra and @vinopaljiri's repository for IDA Pro. After making use of the plugin, all of the base64-encoded + encrypted strings are available for further analysis.

Cruciferra uses SplitMix64 and Feistel to generate a keystream, which is XORed against the base64 decoded ciphertext - with the counter incrementing every 24-byte block - to produce the plaintext.

The figure below is a truncated view of the routine responsible for generating each block of the keystream. The python script available here can be loaded through Binary Ninja to decrypt all of the strings for the file in question. The full list of decrypted strings is available here. Note, the six initial state QWORDs may need to be updated as they are subject to change from sample to sample.

Cruciferra Panel

Cruciferra's panel provides an interface for operators to pack files, buy EV certificates, and request support. Important pages are described in the following sections.

Packages

Two packages are currently for sale, both producing different payloads. The PUROSANGUE stub is a side-loaded DLL priced at $1200 per month with EDR/AV killing capabilities, whereas COCONUT is a self-contained EXE with a Windows Defender exclusion capability and is priced at $650 per month.

Crypter

The Crypter section provides operators with the option to select a package described in the prior figure and customization of the final payload, e.g. file pumping, EV certificate signing, custom AV/EDR process names to target.

After package selection, operators are able to configure options to persist the malware on startup, enable the UAC bypass via COM Elevation Moniker / AV+EDR killer feature, and "pump" the final payload (increase it's file size with junk data).

After configuring options, operators are able to customize targeted processes for termination - a total of 145 process names are configured by default.

The next step in the payload generation process allows threat actors to upload the payload to pack and specify the injection target for Process Hollowing, which defaults to ServiceModelReg.exe, a legitimate, Microsoft-signed binary.

AV/EDR Killer

The table below displays process names we found in the sample in question after decrypting strings, which are identical to the process names shown in Figure 15. The FNV-1a hashing algorithm is used to match targeted process names. There are additional process names that are targeted, e.g. surfshark.exe, which are not included in the table as they are not related to any AV/EDR product.

The malware requires administrator privileges and attempts to elevate privileges via the COM Elevation Moniker. This is followed by decrypting the driver, writing it to C:\Windows\Temp\DCRCVDrv.sys, creating a service for it, and opening a handle to the driver via symbolic link \\\\.\\DCRCVDRV_U.

The figure below displays a truncated portion of the routine within the malware that serves to send the IOCTL control code to the vulnerable driver with each PID found in the scanning process in the input buffer.

The vulnerable code that handles this control code within the driver is shown in the next figure, which passes the PID to terminate to a sub-routine (shown here as sub_12280) which calls ZwTerminateProcess, terminating each AV/EDR process from the kernel.

API Hashing

APIs needed for process enumeration and injection are resolved through a custom algorithm that hashes exports of kernel32.dll and ntdll.dll. The figure below displays the top-level routine responsible for resolving: CreateProcessW, NtQueryInformationProcess, ReadProcessMemory, VirtualAllocEx, WriteProcessMemory, GetThreadContext, SetThreadContext, Wow64GetThreadContext, Wow64SetThreadContext, ResumeThread, TerminateProcess, CloseHandle, WaitForSingleObject, and GetExitCodeProcess.

The API hashing routine is shown in the next figure.

The python code below reproduces the malware's API hashing algorithm.

def mw_hash(export_name: bytes) -> int:
    """
    Cruciferra API hashing algorithm
    """
    h = 0xa7e93c1d  # initial seed
    for b in export_name:
        h = (h ^ b) & 0xffffffff  # byte ^ hash
        h = ((h << 13) | (h >> 19)) & 0xffffffff  # rotate hash left 13
        h = (h * 0xc5b7d2a9) & 0xFFFFFFFF  # multiply hash by 0xc5b7d2a9
        h = (h ^ (h >> 15)) & 0xFFFFFFFF  # hash ^ (hash >> 15)
    return h

What did we do?

• Our team of 24/7 SOC Cyber Analysts proactively isolated the affected host to contain the infection on the customer's behalf.
• We communicated what happened with the customer and helped them with remediation efforts.
• TRU is closely monitoring campaigns involving ErrTraffic, Cruciferra, and BYOVDs, and developing up-to-date detection content for eSentire MDR for Endpoint, eSentire MDR for Log, and eSentire MDR for Network.

What can you learn from this TRU Positive?

• Cruciferra's AV/EDR-killing capabilities rely on abusing the signed vulnerable driver DCRCVDrv.sys to terminate AV/EDR processes from the kernel before deploying follow-on payloads.
• ClickFix campaigns continue to evolve as a malware delivery method, with ErrTraffic making it easy for operators to generate convincing fake Google reCAPTCHA, Cloudflare Turnstile, and BSOD lures that trick users into executing malicious PowerShell commands.

Recommendations from the Threat Response Unit (TRU)

• Block the vulnerable driver via EDR/AV console:
  • SHA-256: 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
  • SHA-1: 47d922b0fd5d704025d14ef98ded46e74830a423
  • MD5: 567c158ee0858f8e941d4ab7a6c18dbc
• Implement a Phishing and Security Awareness Training (PSAT) program that educates your employees using real-world scenarios.
• Partner with a 24/7 multi-signal Managed Detection and Response (MDR) services provider for total attack surface visibility, 24/7 threat hunting and disruption, and rapid threat response to prevent attackers from spreading laterally though your environment.
  • However, at the bare minimum, organizations should use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) solution to detect and contain threats.

Indicators of Compromise

The table below lists Indicators of Compromise.

References

• https://github.com/washi1337/ghidra-nativeaot
• https://github.com/Dump-GUY/ida-nativeaot
• https://github.com/YungBinary/binja-nativeaot
• https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service
• https://learn.microsoft.com/en-us/windows/win32/com/the-com-elevation-moniker