Loading story…
Aryaka researchers reported a Russian-speaking threat actor targeting corporate HR teams and recruiters with fake job applications that deliver malware via a resume-themed ISO file, likely distributed through spam and hosted on common cloud storage services. When the ISO is mounted, victims are tricked into executing a disguised Windows shortcut (.lnk) that launches cmd/PowerShell, extracts hidden data from an image file, and runs additional PowerShell in memory. The chain then downloads a decoy archive (e.g., SumatraPDF.zip) from attacker-controlled domains (including resumebuilders.us and thresumebuilder.com), leveraging DLL sideloading (e.g., SumatraPDF.exe loading DWrite.dll) to execute the next-stage payload while blending into normal user activity.
A key capability in the operation is an EDR/AV “killer” component (described as BlackSanta) intended to disable endpoint defenses before follow-on actions such as host profiling and data theft, with much of the activity occurring in memory to reduce forensic artifacts. Aryaka assessed the campaign as low-noise and potentially long-running (over a year), but noted limited telemetry on overall prevalence; the tradecraft is designed to exploit routine hiring workflows where recruiters rapidly open candidate materials and may not scrutinize ISO-mounted content or shortcut execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Aryaka researchers publicly reported the campaign, describing the resume-themed infection chain, anti-analysis behavior, DLL sideloading with a fake SumatraPDF package, process hollowing, and the BlackSanta EDR-killer. They said the final payload could not be confirmed because command-and-control infrastructure was unavailable, though prior infections suggested information theft.
During the campaign, the attackers used a previously undocumented module dubbed BlackSanta to disable endpoint protections. The tool abused vulnerable kernel drivers in a BYOVD technique, altered Microsoft Defender settings, reduced telemetry, and tampered with security processes at the kernel level.
A Russian-speaking threat actor began a stealthy campaign targeting HR departments and recruiters, using recruitment-themed lures that delivered ISO files disguised as resumes via cloud storage or spear-phishing. Researchers said the activity appears to have been running quietly for over a year.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported active phishing activity targeting enterprise users by impersonating routine workplace workflows (e.g., meeting invites, invoices, and document notifications) to trick recipients into running malware. One campaign used executables masquerading as *Microsoft Teams*, *Zoom*, and *Adobe Acrobat Reader* installers (e.g., `msteams.exe`, `zoomworkspace.clientsetup.exe`, `adobereader.exe`, `invite.exe`) that appeared trustworthy because they were **digitally signed** with an Extended Validation (EV) certificate issued to **TrustConnect Software PTY LTD**. Microsoft Defender telemetry attributed the activity to an unknown threat actor and assessed the approach as a deliberate, multi-wave effort designed to bypass user suspicion and basic security controls. After execution, the signed malware deployed **remote monitoring and management (RMM)** tooling—reported examples include **ScreenConnect**, **Tactical RMM**, and **Mesh Agent**—to establish persistent remote access and enable follow-on actions across affected environments. Separately, reporting also highlighted phishing lures distributing **malicious ISO attachments** embedded in job application/resumé-themed emails, reinforcing that attackers continue to rely on socially engineered business processes (recruiting and HR workflows in particular) to deliver initial payloads and gain a foothold.
Jun 29, 2026
Security firms reported multiple spearphishing campaigns that used LinkedIn job applications, fake job offers, and poisoned resumes to deliver the **More_eggs** malware to recruiters, hiring managers, and other business professionals. In observed intrusions, victims were directed through legitimate-looking resume workflows that ended with a malicious archive or shortcut file, often disguised as a document, which launched obfuscated activity and installed the JavaScript-based backdoor. The campaigns were seen across sectors including industrial services, aerospace and defense, legal, accounting, staffing, and healthcare technology, showing a sustained focus on personnel involved in recruiting and hiring. The malware and delivery chain were linked to **Golden Chickens** (also known as **Venom Spider**) and associated tooling such as **VenomLNK**, **TerraLoader**, and **TerraPreter**, though the specific operators behind individual incidents were not always confirmed. The attacks abused signed Windows binaries including **`regsvr32`**, **`wmic`**, **`msxsl.exe`**, **`ie4uinit.exe`**, and in earlier cases **`cmstp`** to evade detection, establish execution, perform discovery, and communicate with command-and-control infrastructure. Defenders said **More_eggs** can support credential theft, data exfiltration, lateral movement, remote access, and follow-on ransomware activity, and in at least one case endpoint telemetry caught suspicious XSL script processing and related malicious behavior before the intrusion succeeded.
Aug 15, 2026
A targeted cyber-espionage campaign dubbed Operation DupeHike has been uncovered, focusing on Russian corporate entities, particularly human resources, payroll, and internal administrative departments. Attackers used spear-phishing emails containing ZIP archives with decoy documents themed around employee bonuses and internal financial policies. The infection chain begins with a malicious LNK file, which, when executed, deploys a previously unknown implant named DUPERUNNER. This implant subsequently loads the AdaptixC2 beacon, establishing command-and-control communications with the threat actor's infrastructure via process injection techniques. Technical analysis reveals that the campaign leverages realistic decoy documents to increase the likelihood of successful compromise. The malware ecosystem is designed for stealth and persistence, with the AdaptixC2 component enabling remote access and control over infected systems. The campaign's infrastructure and tactics suggest a sophisticated threat actor, and indicators of compromise (IOCs) have been published to aid in detection and response. Security researchers recommend heightened vigilance for organizations in the Russian corporate sector, especially those handling sensitive HR and payroll data, and advise updating security controls to detect similar spear-phishing and process injection techniques.
Jun 29, 2026