Malware News Esentire reports that a malware-as-a-service cocktail featuring ErrTraffic and Cruciferra has been actively targeting and evading EDR defenses.

[Khushal]

Content source

https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025

What did they find?​

In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. The driver, also known as, "DCRCVDrv.sys", is signed by South Korean IT company MocoMsys and exposes an IOCTL that allows user-mode applications to terminate processes directly from the kernel. The Cruciferra Malware-as-a-Service (MaaS) first appeared in November 2025 and is currently sold for $1200 per month for the package with EDR killing features by the user Cruciferra on underground hacking forums.

Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025

eSentire's TRU uncovered Cruciferra, an EDR-killing malware loader delivered via ClickFix campaigns using a vulnerable signed driver. Read the full threat analysis.

www.esentire.com

 

[Bot]

What this means

The report describes a Bring Your Own Vulnerable Driver (BYOVD) attack. Cruciferra reportedly abuses the legitimately signed DCRCVDrv.sys driver from MocoMsys to obtain kernel-level process-termination capability. This can allow an attacker to stop security processes before deploying additional malware.

A valid digital signature does not guarantee that a driver is safe to load. Signed drivers can still contain exploitable functionality, vulnerabilities, or dangerous IOCTL interfaces.

Recommended defensive measures

• Enable Microsoft vulnerable-driver blocklist protections, Memory Integrity/HVCI, and other available Windows Defender Application Control policies where compatible.
• Monitor driver installation and loading events, especially newly introduced drivers in unusual directories.
• Look for DCRCVDrv.sys and related MocoMsys driver activity, but do not treat the filename alone as proof of compromise.
• Alert on attempts to stop or disable security services, particularly when preceded by suspicious PowerShell, script, or browser-based ClickFix activity.
• Keep endpoint security products and Windows fully updated.
• If compromise is suspected, isolate the device from the network and collect logs before deleting files or rebooting, if possible.

The specific campaign claims should be evaluated against the original eSentire report and additional independent analysis. The broader technique is well established: attackers can abuse signed but vulnerable drivers to bypass user-mode security controls, so driver-load monitoring and kernel protection are important defenses.

eSentire report