{"id":24414,"date":"2026-03-13T11:51:27","date_gmt":"2026-03-13T10:51:27","guid":{"rendered":"https:\/\/telecomkh.info\/?p=24414"},"modified":"2026-03-13T11:51:45","modified_gmt":"2026-03-13T10:51:45","slug":"kernel-in-the-crosshairs-the-blacksanta-threat-campaign-targeting-recruitment-workflows","status":"publish","type":"post","link":"https:\/\/telecomkh.info\/?p=24414","title":{"rendered":"Kernel in the crosshairs: The BlackSanta threat campaign targeting recruitment workflows"},"content":{"rendered":"

New threat research report<\/strong><\/p>\n

 <\/p>\n

By Aditya K Sood, Head of Aryaka’s Threat Research Labs & VP of Security Engineering and AI Strategy<\/em><\/span><\/p>\n

The Resume that wasn’t a Resume<\/strong>
\nIt begins in one of the most trusted workflows inside any organization: hiring. An HR professional receives what appears to be a perfectly normal resume. The candidate profile seems relevant. The hosting link points to a familiar cloud storage service. Nothing feels suspicious. A quick download, a double click, and an ISO file mounts, and the intrusion begins.<\/p>\n

Threat Actors targeting Recruitment Workflows<\/strong>
\nThreat actors increasingly target recruitment workflows because they exploit predictable human behavior. Recruitment teams routinely open external attachments, download resumes from unfamiliar sources, and operate under significant time pressure to process large volumes of applicants. Unlike core IT teams, HR environments may not always be subject to the same level of hardened security controls. Yet, they often handle sensitive personally identifiable information (PII) and may have access to internal enterprise systems. This combination of trust, urgency, external interaction, and valuable data makes recruitment functions a soft target with high reward potential\u2014an opportunity this campaign deliberately weaponizes.<\/p>\n

Dissecting the Threat Campaign<\/strong>
\nLet’s discuss the threat campaign briefly from a technical perspective.<\/p>\n

The Infection Chain: Precision in Layers<\/strong>
\n\u2022 Stage 1 \u2013 Initial Access:<\/strong> The attack begins with a resume-themed ISO file delivered through recruitment channels and hosted on a trusted cloud infrastructure. When the victim mounts the ISO and opens its contents, a malicious shortcut (LNK) is executed, triggering the next phase without raising immediate suspicion.<\/p>\n

\u2022 Stage 2 \u2013 Execution and Payload Staging:<\/strong> The shortcut launches obfuscated PowerShell commands that extract hidden payloads embedded within a steganographic image. A malicious DLL is then sideloaded using a legitimate signed application, allowing the attacker’s code to run under the guise of trusted software.<\/p>\n

Command-and-Control (C2) Activity<\/strong>
\nOnce the system passes validation, the malware establishes encrypted HTTPS-based command-and-control communication. It transmits detailed system-fingerprinting data to the attacker’s infrastructure and retrieves cryptographic material needed to decrypt embedded strings and instructions at runtime. Commands are dynamically decrypted and executed in memory, with additional payloads delivered through process hollowing and fileless techniques to minimize forensic artifacts.<\/p>\n

Defense Evasion and Environment Validation<\/strong>
\nBefore activating its full capabilities, the malware conducts rigorous environment validation to evade detection. It inspects hostnames and username patterns, verifies system locale settings, and scans for virtualization artifacts commonly associated with sandboxes. It also checks for debugging tools and security monitoring processes. With connectivity established, additional payloads are injected via process hollowing. BlackSanta, a dedicated BYOVD-based component, disables antivirus and EDR protections at the kernel level, clearing the path for credential harvesting, system reconnaissance, and eventual data exfiltration with minimal resistance.<\/p>\n

Data Collection Objectives<\/strong>
\nAfter compromising endpoint defenses, the malware begins harvesting valuable data from the victim’s machine, including cryptocurrency-related artifacts, etc. The collected data is then exfiltrated discreetly over encrypted channels, allowing the theft operation to proceed with limited visibility once security controls have been weakened.<\/p>\n

The Most Dangerous Component: BlackSanta, the EDR Killer<\/strong>
\nThe campaign’s most alarming feature is an internal module dubbed BlackSanta, the EDR killer.<\/p>\n

This manipulation is not a case of basic tampering; BlackSanta deploys a Bring-Your-Own Vulnerable Driver (BYOVD) technique. First, it loads legitimate but exploitable kernel drivers, gaining low-level system access. Second, it systematically turns off security tools. Once BlackSanta is active, it:
\n\u2022 Terminates antivirus processes.
\n\u2022 Shuts down EDR agents.
\n\u2022 Weakens Microsoft Defender protections.
\n\u2022 Suppresses system logging.
\n\u2022 Removes visibility from security consoles.<\/p>\n

In effect, it clears the runway before exfiltration. As the BlackSanta malware uses signed drivers, detection becomes significantly more difficult.<\/p>\n

Advanced Threat Campaign. Why?<\/strong>
\nIt is not opportunistic malware. It is operationally disciplined intrusion engineering. This operation reflects a mature adversary capable of blending social engineering, living-off-the-land techniques, steganography, and kernel-level abuse to achieve stealthy persistence and credential theft. This operation demonstrates:
\n\u2022 Workflow-specific targeting
\n\u2022 Multi-stage execution
\n\u2022 Living-off-the-land techniques
\n\u2022 Steganographic payload delivery
\n\u2022 Memory-resident execution
\n\u2022 Anti-analysis safeguards
\n\u2022 Kernel-level security bypass<\/p>\n

Strategic Implications<\/strong>
\n\u2022 Recruitment workflows represent a systemic blind spot within the enterprise.
\n\u2022 BYOVD-based EDR neutralization is becoming increasingly operationalized.
\n\u2022 Security monitoring must extend beyond traditional phishing detection into behavioral and driver-level telemetry.<\/p>\n

Conclusion<\/strong>
\nThis campaign demonstrates a multi-layered intrusion model blending social engineering, living-off-the-land execution, steganographic concealment, kernel-level exploitation, and encrypted C2 coordination. Recruitment pipelines, often perceived as routine operations, are now high-value attack surfaces. Organizations should treat HR workflows with the same defensive rigor as finance and IT administrative functions.<\/p>\n

Above, Dr. Aditya Sood \/ Is Head of Aryaka’s Threat Research Lab & VP Security Engineering and AI Security. He is author of a number of books including \u00abTargeted Cyber Attacks\u00bb and \u00abEmpirical Cloud Security\u00bb. He is an active speaker at industry conferences including Blackhat, DEFCON, RSA and many others<\/em><\/span><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

New threat research report   By Aditya K Sood, Head of Aryaka’s Threat Research Labs & VP of Security Engineering and AI Strategy The Resume that wasn’t a Resume It begins in one of the most trusted workflows inside any organization: hiring. An HR professional receives what appears to be a perfectly normal resume. The … <\/p>\n

Continue reading \u00abKernel in the crosshairs: The BlackSanta threat campaign targeting recruitment workflows\u00bb<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":24415,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[24],"tags":[],"_links":{"self":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/24414"}],"collection":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=24414"}],"version-history":[{"count":2,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/24414\/revisions"}],"predecessor-version":[{"id":24417,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/24414\/revisions\/24417"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/media\/24415"}],"wp:attachment":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}