Hunt: ESET says the Cruciferra cryptor (a rebrand of KGB) wraps payloads in DLL side-loading chains and kills EDR via vulnerable drivers
- Behaviors to hunt: signed legitimate executables loading an unsigned DLL from the same user-writable folder (side-loading), followed by a vulnerable driver being installed and EDR processes terminating (BYOVD). Turn on Microsoft's vulnerable driver blocklist and alert on new kernel services from user-writable paths.
- Payload stage: Formbook and PureLogs stealers after the chain; rotate browser-stored credentials on hits.
- ESET SHA-1 samples:
F82EFEC209408DEFA3079CFEA863BCFE05A3EF0C,9E16F55B653D7BB2EEC6C02BC96D7B9D6C987561,1DB2928B756A663979AA8B19DA2842D1634C215A,4AD74712215572142FF34327CD6D5D2462E9D157,1CCBA73D611E82A542EAED48DF56B1384606961D. - Proofpoint, eSentire and Recorded Future have also covered Cruciferra, per ESET.
Sources: ESET Research on X: Cruciferra cryptor MaaS thread (Nov 12, 2026) · ESET Research on X: Cruciferra SHA-1 hashes (6/6)