BlackSanta
BlackSanta is a specialized malware module and campaign component described as an EDR killer, operated by a Russian-speaking threat actor and primarily targeting human resources and recruitment personnel. The activity has reportedly been active for about a year or more and uses recruitment-themed social engineering, including resume-themed ISO files hosted on trusted cloud services and delivered via spear-phishing or recruitment channels.
The observed infection chain begins when a victim mounts a malicious ISO and opens a disguised LNK file posing as a PDF. The LNK launches obfuscated PowerShell, which extracts hidden payloads from a steganographic image and executes them in memory. The malware then downloads a ZIP archive containing a legitimate SumatraPDF executable and a malicious DWrite.dll, using DLL sideloading for execution. It performs host fingerprinting, collects system information, communicates with command-and-control infrastructure over HTTPS, retrieves cryptographic material to decrypt strings and instructions at runtime, and conducts anti-analysis checks for sandboxes, virtual machines, debuggers, analysis tools, locale, hostname and username patterns, and other environmental indicators. Additional payloads are executed via process hollowing and fileless techniques.
BlackSanta’s core role is defense neutralization. It is described as a BYOVD-based EDR killer that loads legitimate but vulnerable signed kernel drivers, including RogueKiller Antirootkit/truesight.sys v3.1.0 and IObitUnlocker.sys v1.2.0.1, to gain kernel-level access. Using these drivers, BlackSanta enumerates running processes against a hardcoded list of antivirus, EDR, SIEM, and forensic tools, then unlocks and terminates matching security processes at the kernel level. Reported actions include terminating antivirus processes, shutting down EDR agents, weakening Microsoft Defender protections, adding Defender exclusions for .dls and .sys files, modifying registry settings to reduce telemetry and automatic sample submission, suppressing Windows notifications, and suppressing system logging and visibility in security consoles.
Once defenses are weakened, the broader malware chain enables credential harvesting, system reconnaissance, theft of sensitive files and cryptocurrency-related artifacts, and eventual data exfiltration over encrypted channels. Researchers characterized the operation as a mature, multi-stage intrusion combining social engineering, living-off-the-land techniques, steganography, runtime decryption, DLL sideloading, process hollowing, and kernel-level abuse. Aryaka researchers reported the malware in live campaigns but stated they could not retrieve the final payload in at least one case because the C2 server was unavailable. No specific victim organizations were identified in the provided content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
The shortcut launches obfuscated PowerShell commands that extract hidden payloads embedded within a steganographic image.
“…when someone opens the file, it executes a malicious shortcut (LNK), triggering the next phase…”
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
9 techniques
Stealth
“The shortcut launches obfuscated PowerShell commands…”
The shortcut launches obfuscated PowerShell commands that extract hidden payloads embedded within a steganographic image.
additional payloads delivered through process hollowing and fileless techniques to minimize forensic artifacts.
Suppresses system logging. Removes visibility from security consoles.
Aryaka's Aditya K Sood has uncovered BlackSanta, a new EDR killer that's being used in live malware campaigns.
It transmits detailed system-fingerprinting data to the attacker’s infrastructure and retrieves cryptographic material needed to decrypt embedded strings and instructions at runtime. Commands are dynamically decrypted and executed in memory
It inspects hostnames and username patterns, verifies system locale settings, and scans for virtualization artifacts commonly associated with sandboxes.
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
6 techniques
Discovery
“the HypervisorEnforcedCodeIntegrity registry value is queried to determine whether Memory Integrity is enabled…”
The core function of BlackSanta is to terminate security processes, which it does by: enumerating running processes comparing the names against a large hardcoded list
It transmits detailed system-fingerprinting data to the attacker’s infrastructure
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
Other
4 techniques
Other
...terminate security processes... retrieving the matching process IDs using the loaded drivers to unlock and terminate those processes at the kernel level | It also modifies Windows Defender settings to weaken security... BlackSanta adds Microsoft Defender exclusions... and modifies a Registry value to reduce telemetry and automatic sample submission
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly uncovered tool designed to disable or kill endpoint detection and response products during active malware campaigns.
A specialized module used to disable/evade endpoint detection and response (EDR) tooling as part of a staged infection chain delivered via phishing email. It enables full system compromise/control, performs host reconnaissance (OS, user accounts, configurations), and uses runtime decryption to hinder static detection and forensic analysis.
A BYOVD-based malware component used to disable antivirus, EDR, Microsoft Defender protections, and logging at the kernel level to facilitate stealth, credential theft, reconnaissance, and exfiltration.
A previously undocumented defense-neutralization module ("EDR killer") that uses vulnerable kernel-mode drivers to gain low-level access and tamper with system memory/processes, programmatically identifying and interfering with endpoint security, telemetry, and logging agents prior to follow-on payload deployment.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.