'BlackSanta' EDR Killer Targets HR Workflows
ID: 5f63c681-5860-5def-a0f0-11a0b200f349
STIX ID: report--5f63c681-5860-5def-a0f0-11a0b200f349
Feed Name: Dark Reading
Threat Score
The 'BlackSanta' campaign is a year-long Russian-speaking operation targeting HR recruitment workflows by delivering resume-themed ISO files that execute LNK shortcuts, run obfuscated PowerShell to extract payloads hidden in steganographic images, and sideload legitimately signed kernel drivers to disable antivirus/EDR, suppress logging, and exfiltrate sensitive data, enabling stealthy persistence and credential theft while evading detection.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.