Malware-as-a-Service Cocktail: ErrTraffic, Cruciferra, and EDR Evasion

Summary

Threat actors are using two Malware-as-a-Service (MaaS) offerings, ErrTraffic and Cruciferra, to distribute malicious payloads. ErrTraffic relies on ClickFix social engineering lures delivered through compromised WordPress sites to trick users into running PowerShell commands. Cruciferra acts as an advanced loader that abuses a vulnerable driver through BYOVD to terminate EDR and AV processes at the kernel level.

Investigation

The eSentire Threat Response Unit identified ErrTraffic-generated ClickFix campaigns in July 2026. The investigation uncovered the use of Polygon smart contracts to resolve C2 domains and identified the Cruciferra loader using process hollowing to inject the Remus info stealer. Researchers also examined the malware’s custom API hashing and string encryption techniques.

Mitigation

Organizations should block the vulnerable DCRCVDrv.sys driver through their EDR or AV platforms. Implementing a Phishing and Security Awareness Training (PSAT) program can help reduce the effectiveness of ClickFix social engineering. Deploying a Next-Gen AV or EDR solution should be considered a minimum baseline for protecting endpoints against these threats.

Response

If malicious activity is detected, affected hosts should be isolated immediately to contain the infection. Security teams should monitor for suspicious PowerShell execution following interaction with web-based CAPTCHA or BSOD lures. Organizations should also coordinate with a 24/7 Managed Detection and Response (MDR) provider for rapid threat hunting, containment, and disruption.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deploy the Cruciferra malware suite. First, they deploy a renamed or specifically named legitimate executable (ServiceModelReg.exe) into a writable directory. They place a malicious version of mscoree.dll in the same directory to trigger DLL Side-loading upon execution. Finally, to disable security software, they attempt to load the vulnerable DCRCVDrv.sys driver into the kernel. This sequence is designed to establish persistence and then blind the defender by terminating EDR processes from the kernel level.

• Regression Test Script:

  # Simulation of Cruciferra TTPs
  $workDir = "$env:TEMPCruciferra_Sim"
  New-Item -ItemType Directory -Path $workDir -Force
  Set-Location $workDir
  
  Write-Host "[+] Creating simulated malicious files..."
  # Create dummy files to mimic the names targeted by the rule
  New-Item -ItemType File -Name "ServiceModelReg.exe" -Force
  New-Item -ItemType File -Name "mscoree.dll" -Force
  New-Item -ItemType File -Name "DCRCVDrv.sys" -Force
  
  Write-Host "[+] Simulating DLL Side-loading (Image Load Event)..."
  # In a real scenario, executing the EXE would load the DLL. 
  # For simulation, we can use a script to trigger the load event if Sysmon is watching.
  # Since we can't easily 'load' a fake .sys without admin/driver signing, 
  # we use a method to trigger the Sysmon 'Image Load' telemetry.
  
  # Using PowerShell to simulate the 'Image Load' telemetry for the driver
  # Note: This may require Admin privileges to actually load a driver, 
  # but for detection testing, we are looking for the Sysmon event.
  # We will simulate the load via a process that calls these names.
  
  Write-Host "[+] Simulating Driver Load and Executable execution..."
  # Note: This is a simulation of the telemetry. 
  # To ensure Sysmon captures it, we'll attempt to reference them.
  Start-Process ".ServiceModelReg.exe" -WindowStyle Hidden
  
  # For the purpose of this test, we assume the files exist. 
  # To trigger the specific 'endswith' logic, the files must be present.
  Write-Host "[!] Simulation complete. Check Sysmon Event ID 7."

• Cleanup Commands:

  # Cleanup simulation artifacts
  Remove-Item -Path "$env:TEMPCruciferra_Sim" -Recurse -Force
  Write-Host "[+] Cleanup complete."