Russian hackers target HR departments with vicious new 'BlackSanta' malware

• Russian hackers target HR departments with BlackSanta malware
• Infection chain uses phishing emails and malicious ISO files
• BlackSanta disables EDR tools to enable deeper compromise

Russian hackers have been targeting Human Resources (HR) departments at various organizations around the world with a never-before seen piece of malware called BlackSanta.

The campaign was spotted by cybersecurity researchers Aryaka, who said the attacks have been going on for at least a year, and include a rather sophisticated infection chain.

It most likely starts with a phishing email pretending to share resumes for potential employees, including a link to a Dropbox folder holding an ISO image. These files are clones of optical discs and were rather popular in the early 2000’s until thumb drives became more affordable. These days, however, they can be seen as a major red flag since they are rarely used outside of scams.

Article continues ...