Malware-as-a-Service Cocktail: ErrTraffic, Cruciferra, and EDR Evasion

Threat actors are using two Malware-as-a-Service (MaaS) offerings, ErrTraffic and Cruciferra, to distribute malicious payloads. ErrTraffic relies on ClickFix social engineering lures delivered through compromised WordPress sites to trick users into running PowerShell commands. Cruciferra acts as an advanced loader that abuses a vulnerable driver through BYOVD to terminate EDR and AV processes at the kernel level.

The eSentire Threat Response Unit identified ErrTraffic-generated ClickFix campaigns in July 2026. The investigation uncovered the use of Polygon smart contracts to resolve C2 domains and identified the Cruciferra loader using process hollowing to inject the Remus info stealer. Researchers also examined the malware’s custom API hashing and string encryption techniques.

Organizations should block the vulnerable DCRCVDrv.sys driver through their EDR or AV platforms. Implementing a Phishing and Security Awareness Training (PSAT) program can help reduce the effectiveness of ClickFix social engineering. Deploying a -Gen AV or EDR solution should be considered a minimum baseline for protecting endpoints against these threats.

If malicious activity is detected, affected hosts should be isolated immediately to contain the infection. Security teams should monitor for suspicious PowerShell execution following interaction with web-based CAPTCHA or BSOD lures. Organizations should also coordinate with a 24/7 Managed Detection and Response (MDR) provider for rapid threat hunting, containment, and disruption.

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

Attack Narrative & Commands: The adversary aims to deploy the Cruciferra malware suite. First, they deploy a renamed or specifically named legitimate executable ( ServiceModelReg.exe ) into a writable directory. They place a malicious version of mscoree.dll in the same directory to trigger DLL Side-loading upon execution. Finally, to disable security software, they attempt to load the vulnerable DCRCVDrv.sys driver into the kernel. This sequence is designed to establish persistence and then blind the defender by terminating EDR processes from the kernel level.

Regression Test Script:

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.