Malware · 29 Aug 2026 · Rob Nidschelm

The Signed Driver’s Job Was to Kill Your EDR.

A malware-as-a-service chain is combining compromised WordPress sites, ClickFix lures, signed Microsoft binaries and a signed vulnerable driver to disable endpoint security before deploying an information stealer. The campaign is less a collection of isolated tricks than a productised lesson in how attackers turn trusted components against defenders.

eSentire says it observed several ErrTraffic-generated ClickFix campaigns delivering the Cruciferra loader in late July 2026. Compromised WordPress sites presented fake Google reCAPTCHA, Cloudflare Turnstile or blue-screen instructions that persuaded victims to run malicious PowerShell.

Once the victim crosses that human boundary, the chain escalates privileges, abuses a kernel driver to terminate security processes, side-loads a malicious DLL through a signed Microsoft executable and hollows another signed Microsoft process before deploying the Remus information stealer.

The first exploit is social, not technical

ClickFix campaigns replace a conventional malicious download with instructions. The page claims the user must complete a verification step or resolve an error, then asks the user to copy and execute a command. The operating system sees a person launching PowerShell rather than a browser exploiting a memory-safety flaw.

ErrTraffic industrialises that delivery layer. eSentire describes compromised WordPress sites injected with obfuscated JavaScript and command-and-control resolution through Ethereum and Polygon smart contracts. The combination gives operators disposable web infrastructure and a resilient way to locate backend systems.

The lure still requires user action. That prerequisite does not make the later capability negligible. It changes where defenders can interrupt the attack: browser controls, web filtering, PowerShell telemetry and user education become part of the same detection story as kernel and endpoint events.

Cruciferra turns EDR killing into a subscription feature

eSentire links the delivery to Cruciferra, a PUROSANGUE malware package advertised at $1,200 per month. One of its selling points is the ability to kill endpoint detection and response processes. That matters strategically because a specialist evasion capability is being sold as a reusable service rather than kept inside one threat actor’s private toolkit.

The malware uses a signed but vulnerable driver named DCRCVDrv.sys. The driver exposes an input/output control that can terminate processes from the Windows kernel. Cruciferra’s default target list contains 145 process names associated with products from Microsoft, CrowdStrike, SentinelOne, Sophos, Trend Micro, Bitdefender, Palo Alto Networks and many other security vendors.

This is a bring-your-own-vulnerable-driver technique. The operating system accepts the driver’s valid signature, but the code exposes a dangerous capability. Malware running with administrator privileges can ask that trusted kernel component to perform an operation that user-mode security software would normally block or observe.

Administrator access is a real prerequisite. Cruciferra attempts to obtain it through the Windows COM Elevation Moniker. The security consequence is the new capability gained after elevation: targeted termination of defensive processes from kernel context.

Signed Microsoft binaries become camouflage

The chain then uses a signed Microsoft utility, vb7to8.exe, to load a malicious mscoree.dll placed beside it. Windows DLL search behaviour can cause the executable to select the attacker’s library instead of the intended system component. The trusted signature belongs to the loader, not to the code that the loader ultimately brings into the process.

Cruciferra also uses process hollowing against the signed Microsoft binary ServiceModelReg.exe. It starts the process, replaces its legitimate code and continues execution under a familiar name. The Remus information stealer then operates behind multiple layers of trust and process identity.

The lesson is not that signatures are useless. Code signing remains an important signal. The failure comes from treating one positive signal as a complete verdict. A signed file can be vulnerable, a signed executable can load an unsigned library, and a legitimate process can contain attacker-controlled code.

Elastic turned a giant detection list into one behaviour

Elastic independently reconstructed the malicious mscoree.dll technique and published its analysis on 28 August. The team built a NativeAOT library, placed it beside vb7to8.exe and reproduced the DLL search-order hijack.

Elastic’s earlier detection example for this class of behaviour required roughly 88 lines, about 2,600 DLL names, path exclusions, signature checks and timing logic. Elastic Defend 9.5.0 now enriches qualifying events with dll.Ext.defense_evasions: "DLL Hijack: Masquerading". A rule can target the behaviour with one expression instead of maintaining a long list of individual filenames.

That does not make tuning disappear. Legitimate applications can use unusual library layouts, and environment context still matters. The advantage is durability. A behavioural signal is more likely to survive a changed DLL name, a different signed loader or the next campaign built from the same primitive.

Where defenders can break the chain

• Stop the instruction lure. Block known ClickFix infrastructure, monitor browser-to-PowerShell transitions and train users that verification pages should never require pasted shell commands.
• Constrain script execution. Use PowerShell logging, application control and restricted execution policies to make copied commands visible and harder to run.
• Reduce elevation opportunities. Remove local administrator rights where possible and alert on unusual COM elevation, new services and driver loads.
• Control vulnerable drivers. Apply Microsoft’s vulnerable-driver blocklist, enforce memory integrity where supported and hunt for unexpected loading of DCRCVDrv.sys or related driver artifacts.
• Detect the trust mismatch. Alert when signed binaries load libraries from user-writable or application-adjacent directories, especially when the loaded module lacks an expected signature or path.
• Protect application directories. Standard users should not be able to place DLLs beside privileged or trusted executables. Developers should use qualified paths and restricted DLL search flags.
• Correlate process termination. Multiple security tools stopping near a new driver load or privilege-elevation event should be treated as an incident, not as unrelated product crashes.

The BlackTree view

Cruciferra packages several familiar techniques into one commercial chain: social engineering, elevation, vulnerable-driver abuse, DLL side-loading, process hollowing and credential theft. The innovation is not a single primitive. It is the delivery of those primitives as a repeatable service.

Defenders should resist the temptation to solve this with one more hash or filename. The stable story is behavioural: a user is persuaded to launch a script, a driver appears, security processes die, a signed binary loads code from an unexpected directory and a second trusted process changes identity.

Trust signals still matter, but they must be evaluated as a chain. Signed is not the same as safe. Familiar is not the same as legitimate. A productised attacker will deliberately build inside the gaps between those assumptions.

Sources

• eSentire technical analysis of ErrTraffic and Cruciferra, published 19 August 2026. The source provides no publication time.
• Elastic Security Labs reconstruction and detection analysis, published 28 August 2026. The source provides no publication time.
• F5 Labs Weekly Threat Bulletin, published 26 August 2026. The source provides no publication time.