New ‘BlackSanta’ EDR killer spotted targeting HR departments A Russian-speaking threat actor targeted HR departments for over a year using spear-phishing ISO "resumes" that deploy a sophisticated EDR killer called BlackSanta. BlackSanta weakens and terminates endpoint protections via Defender exclusions, registry changes, notification suppression, DLL sideloading, and kernel‑level process termination. #BlackSanta #RogueKiller

A Russian-speaking threat actor has targeted HR departments with spear-phishing ISO "resumes" deploying BlackSanta, an advanced EDR killer using Defender exclusions, registry edits, DLL sideloading, and kernel process termination. #BlackSanta #HRattacks