New ‘BlackSanta’ EDR killer spotted targeting HR departments

A Russian-speaking threat actor ran a year-long spear-phishing campaign targeting HR departments that delivered a sophisticated EDR-killer called BlackSanta. The attack chain used malicious ISO files (LNK launching PowerShell), steganography, DLL sideloading, process hollowing, and brought in kernel-capable drivers (RogueKiller, IObitUnlocker) to terminate security processes, weaken Defender settings, and exfiltrate sensitive data while avoiding detection.