BlackSanta Report

Aryaka Threat Labs describes a sophisticated, Russian‑language campaign targeting HR and recruitment personnel using resume-themed spear‑phishing (ISO with malicious LNK) that runs an obfuscated PowerShell loader (LSB steganography) to sideload a malicious DWrite.dll. The DLL beacons to C2 to retrieve AES keys for runtime decryption, downloads additional payloads (including an EDR‑killer called BlackSanta), leverages vulnerable kernel drivers to neutralize AV/EDR and perform stealthy process termination and process hollowing, and is capable of exfiltration; the report includes IOCs, infrastructure pivots, and MITRE ATT&CK mappings.