In late July 2026, eSentire TRU reported ErrTraffic-generated ClickFix campaigns that delivered the Cruciferra loader, which abused the signed vulnerable driver DCRCVDrv.sys to kill AV/EDR processes from the kernel. The campaigns used compromised WordPress sites, blockchain-based dead-drop C2 infrastructure, and fake CAPTCHA/BSOD lures to trick victims into running malicious PowerShell while deploying Remus through side-loading and process hollowing. #Cruciferra #ErrTraffic #DCRCVDrvsys #Remus #MocoMsys #ServiceModelRegexe
Keypoints
- eSentire TRU identified multiple ErrTraffic-generated ClickFix campaigns in late July 2026.
- The campaigns delivered Cruciferra, a Malware-as-a-Service loader marketed with EDR-killing features.
- Cruciferra abused the signed vulnerable driver DCRCVDrv.sys to terminate AV/EDR processes from the kernel.
- ErrTraffic used compromised WordPress sites and obfuscated JavaScript injects to serve fake Google reCAPTCHA, Cloudflare Turnstile, or BSOD lures.
- The infrastructure relied on Ethereum and Polygon smart contracts to resolve and rotate dead-drop C2 domains.
- The attack chain used malicious PowerShell, DLL side-loading, and process hollowing to deploy the Remus information stealer.
- Cruciferra’s panel offered operators packaging, UAC bypass, persistence, process targeting, and payload customization options.
MITRE Techniques
- [T1574.001] DLL Search Order Hijacking – A legitimate Microsoft-signed binary was used to load the Cruciferra DLL through side-loading (‘a legitimate, Microsoft signed binary was used to side-load the Cruciferra DLL (mscoree.dll)’).
- [T1055.012] Process Hollowing – Cruciferra injected Remus into the address space of a legitimate signed binary (‘uses process hollowing to inject the Remus information stealer into the address space of the legitimate, Microsoft-signed binary ServiceModelReg.exe’).
- [T1112] Modify Registry – The malware created a service for the driver, indicating registry-based service installation for the BYOVD component (‘creating a service for it’).
- [T1548.002] Bypass User Account Control – The malware enabled UAC bypass via COM Elevation Moniker (‘enable the UAC bypass via COM Elevation Moniker / AV+EDR killer feature’).
- [T1055] Process Injection – The campaign used injected scripts and malicious payload execution stages to run code in other processes (‘dynamically load the ClickFix lure’s JavaScript source code’, ‘inject the Remus information stealer’).
- [T1027] Obfuscated Files or Information – The ErrTraffic inject was base64-encoded and XOR-encrypted, and the JavaScript loader was obfuscated (‘base64-encoded and XOR-encrypted with a single-byte key’).
- [T1105] Ingress Tool Transfer – The C2 returned the ClickFix lure source code and later-stage content for delivery to victims (‘The response from the C2 contains the ClickFix lure’s JavaScript source code’).
- [T1218.002] System Binary Proxy Execution: Mshta – The article does not name mshta, so no direct match is present; excluded if strictly limited to mentioned techniques.
- [T1059.001] PowerShell – Victims were instructed to paste and execute a malicious PowerShell command (‘copies a malicious PowerShell command to the victim’s clipboard’).
- [T1106] Native API – The malware resolved low-level Windows APIs for enumeration, injection, and termination by hashing exports (‘APIs needed for process enumeration and injection are resolved through a custom algorithm that hashes exports of kernel32.dll and ntdll.dll’).
Indicators of Compromise
- [SHA-256 ] Malware/sample hashes – 0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce, 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
- [Domain Name ] ErrTraffic C2 and compromised site – makeverizyjar[.]info, analysis-id-fmd[.]info
- [Domain Name ] Additional ErrTraffic/related infrastructure – analysis-id-lfg[.]info, karmactive[.]com
- [Domain Name ] Remus C2 infrastructure – tzpx[.]courses, zelpx[.]garden
- [IPv4 ] ErrTraffic C2 – 178.16.52[.]101
- [File Name ] Vulnerable driver and payload component – DCRCVDrv.sys, mscoree.dll