---
title: Hunt: ESET says the Cruciferra cryptor (a rebrand of KGB) wraps payloads in DLL side-loading chains and kills EDR via vulnerable drivers | ctxsec
url: https://ctxsec.com/items/hunt-eset-cruciferra-cryptor-maas-kgb-rebrand-byovd-dll-sideloading-formbook-purelogs
description: "ESET says it has blocked more than 700,000 compromise attempts involving Cruciferra since January 2026, a crypter-as-a-service sold since October 2025 that stands out for the variety of its decryption routines. ESET assesses it is a rebrand of the long-running KGB cryptor. Detections peaked near 60,000 endpoints (3-day average) in March; affiliates used it for payloads such as Formbook and PureLogs, mostly against T\u00fcrkiye, Greece and Spain. After its domain was seized in mid-October, the operator resurfaced offering exclusive $5,000-per-build cryptors pitched against enterprise EDR, advertised with a claimed bundled kernel 0-day (spotted by Flare)."
status: "vendor research (ESET Research thread, Nov 12, 2026); the bundled kernel 0-day is the operator's advertising claim, not verified"
published: 2026-11-12
---

> ESET says it has blocked more than 700,000 compromise attempts involving Cruciferra since January 2026, a crypter-as-a-service sold since October 2025 that stands out for the variety of its decryption routines. ESET assesses it is a rebrand of the long-running KGB cryptor. Detections peaked near 60,000 endpoints (3-day average) in March; affiliates used it for payloads such as Formbook and PureLogs, mostly against Türkiye, Greece and Spain. After its domain was seized in mid-October, the operator resurfaced offering exclusive $5,000-per-build cryptors pitched against enterprise EDR, advertised with a claimed bundled kernel 0-day (spotted by Flare).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-eset-cruciferra-cryptor-maas-kgb-rebrand-byovd-dll-sideloading-formbook-purelogs.md)

vendor research (ESET Research thread, Nov 12, 2026); the bundled kernel 0-day is the operator's advertising claim, not verified

2026-11-12 7:40 AM ET

### Hunt: ESET says the Cruciferra cryptor (a rebrand of KGB) wraps payloads in DLL side-loading chains and kills EDR via vulnerable drivers

- **Behaviors to hunt:** signed legitimate executables loading an unsigned DLL from the same user-writable folder (side-loading), followed by a vulnerable driver being installed and EDR processes terminating (BYOVD). Turn on Microsoft's vulnerable driver blocklist and alert on new kernel services from user-writable paths.
- **Payload stage:** Formbook and PureLogs stealers after the chain; rotate browser-stored credentials on hits.
- **ESET SHA-1 samples:** `F82EFEC209408DEFA3079CFEA863BCFE05A3EF0C`, `9E16F55B653D7BB2EEC6C02BC96D7B9D6C987561`, `1DB2928B756A663979AA8B19DA2842D1634C215A`, `4AD74712215572142FF34327CD6D5D2462E9D157`, `1CCBA73D611E82A542EAED48DF56B1384606961D`.
- Proofpoint, eSentire and Recorded Future have also covered Cruciferra, per ESET.

Sources: [ESET Research on X: Cruciferra cryptor MaaS thread (Nov 12, 2026)](https://x.com/ESETresearch/status/2120805423485702438) · [ESET Research on X: Cruciferra SHA-1 hashes (6/6)](https://x.com/ESETresearch/status/2120805430439858513)