A Russian-speaking threat actor used malware that delivers a new EDR killer called BlackSanta to target HR departments for over a year.
The campaign, which is described as “sophisticated,” combines sophisticated evasion strategies with social engineering to steal private data from compromised networks.
Although the exact origin of the attack is unknown, researchers at Aryaka, a provider of network and security solutions, believe that spear-phishing emails are used to spread the malware.
They think that targets are instructed to download ISO image files housed on cloud storage sites like Dropbox, which seem like resumes.
Four files were found in one malicious ISO that was examined: a PowerShell script, an image, a.ICO file, and a Windows shortcut (.LNK) masquerading as a PDF file read more about New ‘BlackSanta’ EDR killer spotted targeting HR departments.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.