--- title: Fake job applications pack malware that disables EDR description: A Russian-speaking threat actor is targeting corporate HR teams with fake job applications delivered as ISO disk images hosted on legitimate cloud storage.... canonical: https://daily.dev/posts/fake-job-applications-pack-malware-that-disables-edr-wgmgeboze twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fake job applications pack malware that disables EDR | daily.dev og:description: A Russian-speaking threat actor is targeting corporate HR teams with fake job applications delivered as ISO disk images hosted on legitimate cloud storage.... og:url: https://daily.dev/posts/fake-job-applications-pack-malware-that-disables-edr-wgmgeboze og:image: https://api.daily.dev/og/posts/WGMgEBOZe.png og:image:alt: Fake job applications pack malware that disables EDR og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fake job applications pack malware that disables EDR **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary A Russian-speaking threat actor is targeting corporate HR teams with fake job applications delivered as ISO disk images hosted on legitimate cloud storage. Once opened, the ISO mounts and executes hidden commands that unpack malware concealed inside an image file. The campaign's standout component, dubbed 'BlackSanta,' is an EDR killer that uses the Bring Your Own Vulnerable Driver (BYOVD) technique to load legitimate but flawed kernel drivers, gaining deep system access to disable antivirus, EDR agents, and Microsoft Defender. With defenses neutralized, the malware exfiltrates sensitive files and cryptocurrency artifacts over encrypted channels. Aryaka researchers highlight that HR workflows—where staff routinely download files from strangers under time pressure—have become an increasingly attractive attack vector that organizations should defend with the same rigor as finance and IT systems. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Resumés with malicious ISO attachments are circulating, says Aryaka](https://daily.dev/posts/resum-s-with-malicious-iso-attachments-are-circulating-says-aryaka-pbkfyg6n8) · CSO Online · 1 upvotes · 0 comments - [How the GodDamn Ransomware Driver Bypasses Your EDR](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) · Latest Hacking News · 0 upvotes · 0 comments - [Black Basta Bundles BYOVD With Ransomware Payload](https://daily.dev/posts/black-basta-bundles-byovd-with-ransomware-payload-xkktwsdyu) · Dark Reading · 1 upvotes · 0 comments - [Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform](https://daily.dev/posts/threat-actor-adds-advanced-edr-killer-tools-to-ransomware-as-a-service-platform-vgthonbtl) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/fake-job-applications-pack-malware-that-disables-edr-wgmgeboze) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fake job applications pack malware that disables EDR","url":"https://daily.dev/posts/fake-job-applications-pack-malware-that-disables-edr-wgmgeboze","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fake-job-applications-pack-malware-that-disables-edr-wgmgeboze"},"datePublished":"2026-03-10T13:36:21.023Z","dateModified":"2026-03-11T17:41:10.146Z","description":"A Russian-speaking threat actor is targeting corporate HR teams with fake job applications delivered as ISO disk images hosted on legitimate cloud storage....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6002da2535e294f5cde055c0230dc6e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6002da2535e294f5cde055c0230dc6e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fake-job-applications-pack-malware-that-disables-edr-wgmgeboze","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Fake job applications pack malware that disables EDR"}]} ```