The Resume Trap: How ‘BlackSanta’ Malware Uses Fake CVs to Blind EDRs and Hijack HR Systems

Aryaka Threat Labs describes the BlackSanta campaign — a sophisticated, Russian-speaking threat actor operation that weaponizes resume-themed ISO files delivered to HR/recruitment staff; the ISO contains a malicious .LNK that launches a multi-stage chain including an EDR-killer that uses Bring Your Own Driver techniques to neutralize antivirus/EDR, a steganographically hidden PowerShell loader, environment and locale checks to avoid CIS targets, and modules that steal cryptocurrency wallet artifacts.