<p>A Russian-speaking threat actor has been running a spear-phishing campaign for over a year, targeting corporate HR and recruiting staff with fake job applications. The campaign has stayed largely under the radar thanks to a technically sophisticated attack chain that ultimately disables endpoint defenses before stealing data.</p>
<h2>How the attack works</h2>
<p>The initial lure is an ISO disk image disguised as a resume, delivered via legitimate cloud storage services. When a recruiter opens it, the ISO mounts and automatically executes a malicious LNK shortcut. That shortcut runs obfuscated PowerShell commands, which extract a hidden payload from a steganographic image file. A legitimate signed application then sideloads a malicious DLL, completing the installation.</p>
<p>The standout component is a module researchers have named <strong>BlackSanta</strong> - an EDR killer that uses the Bring Your Own Vulnerable Driver (BYOVD) technique. It loads a legitimate but flawed kernel driver to gain low-level system access, then uses that access to disable antivirus software, EDR agents, Microsoft Defender, and system logging. Once defenses are neutralized, the malware exfiltrates sensitive files and cryptocurrency artifacts over encrypted HTTPS to a command-and-control server.</p>
<p>The campaign has avoided detection through a combination of runtime encryption, sandbox evasion, and kernel-level manipulation.</p>
<h2>Why HR is the target</h2>
<p>Recruiters routinely download files from strangers under time pressure - it’s just part of the job. That workflow makes HR teams an attractive target that often doesn’t get the same defensive attention as finance or IT systems. Researchers at Aryaka, who analyzed the campaign, argue that should change.</p>
<p>Recommended mitigations include endpoint hardening on HR workstations, controls on attachment types that can be opened, and security awareness training specifically for recruiting teams. The same rigor applied to finance and IT administrative functions needs to extend to anyone whose job involves opening files from unknown senders.</p>


Collections

A Russian-speaking threat actor has been targeting corporate HR and recruiting staff for over a year with spear-phishing emails disguised as fake job applications. The attack chain begins with an ISO image delivered via cloud storage, which auto-executes a malicious LNK shortcut, runs obfuscated PowerShell, and extracts a payload hidden in a steganographic image via DLL sideloading. The core component, BlackSanta, is an EDR killer that uses the Bring Your Own Vulnerable Driver (BYOVD) technique to load a flawed kernel driver, disable antivirus, EDR agents, Microsoft Defender, and system logging, then exfiltrates files and cryptocurrency artifacts over HTTPS. HR teams are targeted because opening files from strangers is routine for recruiters, yet they often receive less security attention than finance or IT. Recommended mitigations include endpoint hardening on HR workstations, attachment type controls, and security awareness training for recruiting staff.

BlackSanta malware uses fake resumes to kill EDR and exfiltrate data from HR teams