The activity combines fake CAPTCHA pages, PowerShell execution, DLL side-loading, process hollowing, and a vulnerable signed driver to deploy the Remus information stealer.
The campaign begins on compromised WordPress websites injected with obfuscated ErrTraffic JavaScript. ErrTraffic is a malware-as-a-service platform reportedly sold by the actor “LenAI,” offering operators customizable ClickFix templates that impersonate Google reCAPTCHA, Cloudflare Turnstile, and Windows Blue Screen of Death errors.
When a victim opens an infected site, the JavaScript queries a Polygon smart contract to obtain the current command-and-control server.
This blockchain-based dead-drop method lets operators rotate C2 infrastructure without reinfecting or modifying every compromised website. The script then fetches a lure from the C2 server.
Cruciferra EDR Killer Campaign
The lure tells victims to “verify” themselves by opening PowerShell through Windows Key + X, selecting Terminal or PowerShell, and pasting a command already copied to their clipboard.
This is the defining ClickFix technique, instead of exploiting a software flaw, attackers manipulate users into executing the malicious command themselves.
The resulting PowerShell stages use a legitimate Microsoft-signed binary to side-load a malicious mscoree.dll file containing Cruciferra.
DLL side-loading lets attackers place a malicious library beside a trusted application so the legitimate program loads the attacker-controlled file, helping the malware blend into normal activity. MITRE ATT&CK tracks this behavior as T1574.001.
Cruciferra then uses process hollowing to inject Remus into the memory of ServiceModelReg.exe, another Microsoft-signed executable.
In process hollowing, malware starts a legitimate process in a suspended state, replaces its memory with malicious code, and resumes it masking execution under a trusted process name.
Cruciferra, marketed as a malware loader or “crypter,” appeared on underground forums in November 2025. Its PUROSANGUE package reportedly costs $1,200 per month and includes UAC-bypass and EDR-killing options.
The campaign analyzed by TRU used this package to target security products before deploying follow-on payloads. The malware abuses the signed DCRCVDrv.sys driver, associated with South Korean IT firm MocoMsys.
After obtaining administrator privileges, Cruciferra writes the driver to C:\Windows\Temp\DCRCVDrv.sys, registers it as a service, and communicates with it through \\.\DCRCVDRV_U.
The driver exposes IOCTL 0x2205C0, allowing a user-mode process to provide a target process ID. Its vulnerable kernel-mode routine calls ZwTerminateProcess, enabling Cruciferra to stop security tools from the kernel.
This bring-your-own-vulnerable-driver approach is especially dangerous because the driver is signed, allowing attackers to leverage trusted code for destructive behavior, eSentire said.
Indicators of Compromise
| Type | Value | Description |
|---|---|---|
| SHA-256 | 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff | Vulnerable BYOVD driver: DCRCVDrv.sys |
| SHA-1 | 47d922b0fd5d704025d14ef98ded46e74830a423 | Vulnerable BYOVD driver: DCRCVD |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
