BlackSanta EDR killer hits HR teams via résumé ISOs and vulnerable drivers

Aryaka researchers have described a campaign that has targeted HR departments for more than a year. It uses fake résumés to deliver "BlackSanta", a component that disables endpoint security at the kernel level before the real payload arrives. For engineering and IT teams, the interesting parts are the techniques: ISO containers, LNK files, steganography, DLL sideloading and bring-your-own-vulnerable-driver (BYOVD). Each has a specific, configurable defence.

What happened

Aryaka published its findings on 10 March 2026. It describes a Russian-speaking actor and has not named victims. Aryaka suspects initial access comes through spear-phishing that points recruiters to ISO files posing as CVs, hosted on cloud storage such as Dropbox. One ISO it analysed held four files: a Windows shortcut disguised as a PDF, a PowerShell script, an image and an icon file.

The chain works like this. The shortcut runs PowerShell. The script pulls code hidden in the image through steganography and runs it in memory. That stage downloads a ZIP containing a legitimate SumatraPDF executable and a malicious DWrite.dll, so the trusted program loads the attacker's DLL (DLL sideloading). The malware fingerprints the host, checks for sandboxes, VMs and debuggers, runs disk-write tests, and receives more payloads from its C2 server, which it runs through process hollowing.

BlackSanta then prepares the ground. It adds Microsoft Defender exclusions for .sys and other file types, changes a registry value to reduce telemetry and automatic sample submission, and can suppress Windows notifications. Next it lists running processes, matches them against a long hardcoded list of antivirus, EDR, SIEM and forensic tools, and terminates them from kernel mode using two legitimately signed drivers:

• RogueKiller Antirootkit driver v3.1.0 (Adlice Software, truesight.sys), which can manipulate kernel hooks and memory.
• IObitUnlocker.sys v1.2.0.1 (IObit), which can bypass file and process locks.

Aryaka couldn't recover the final payload because the C2 server was offline during analysis. It did find more infrastructure, which is how it established that the operation had run for over a year.

Who is affected

• HR and recruiting staff, whose job involves opening attachments from strangers.
• Windows endpoints where users can mount ISOs, run LNK files and load signed but vulnerable drivers.
• Security teams that rely on a single EDR agent with no tamper alerting. If BlackSanta succeeds, the endpoint stops reporting.

What it means for developers and engineering teams

BYOVD is the key technique. Windows only loads signed drivers, so attackers bring an old, legitimately signed driver with a known flaw or a too-powerful interface, and use it as a kernel-mode tool to kill protected processes. User-mode protections can't stop this. The defences are policy-based: block known-vulnerable drivers before they load, and alert when security tools stop reporting.

The delivery chain also shows why file-type policy matters. ISO files were popular with attackers because files inside a mounted image could escape Mark-of-the-Web handling on older Windows builds, and LNK files run whatever command they contain. DLL sideloading works because Windows searches the application's own folder first, and portable apps such as SumatraPDF are easy to bundle with a malicious DLL. If you ship Windows software, load dependencies from fully qualified paths and use safe DLL search settings so your binary can't be abused the same way.

What to do now

• Turn on the Microsoft Vulnerable Driver Blocklist (Windows Security > Device security > Core isolation) and memory integrity (HVCI) where hardware supports it. Check whether the specific driver versions above are covered in your environment.
• Enable the ASR rule that blocks abused vulnerable signed drivers:

  Add-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 -AttackSurfaceReductionRules_Actions Enabled

• Alert on Defender exclusion changes. Watch Defender event ID 5007 (configuration changed) and review Get-MpPreference | Select ExclusionExtension, ExclusionPath across the fleet.
• Turn on tamper protection, and alert when an endpoint's EDR agent stops checking in.
• Restrict ISO and LNK handling for users who don't need it. Block ISO and IMG attachments at the mail gateway, and ask HR to only accept CVs through an ATS or as plain PDFs.
• Hunt for sideloading: SumatraPDF.exe running from user-writable paths alongside a DWrite.dll, and loads of truesight.sys or IObitUnlocker.sys on machines that don't use those products.

Sources

• BleepingComputer: New 'BlackSanta' EDR killer spotted targeting HR departments
• Aryaka Threat Research Lab
• Infosecurity Magazine: BlackSanta EDR killer targets HR teams in CV-themed campaign
• SC Media: BlackSanta EDR killer malware targets HR departments