HR Departments Targeted by Multi-Layered BlackSanta EDR Killer Malware

The report describes a sophisticated campaign that targets HR teams by sending supposedly legitimate resumes hosted on cloud storage which are actually ISO images containing malicious LNK files. Opening the ISO triggers obfuscated PowerShell which extracts a steganography-hidden payload and sideloads a malicious DLL; the toolkit includes BlackSanta, a BYOVD-capable component that disables endpoint protections at the kernel level, performs fileless in-memory execution, and exfiltrates sensitive artifacts.