# BlackSanta: BYOVD-Based EDR Neutralization Campaign

- **Artifact ID:** CHQ-EX-2026-007
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-007
- **Machine-record SHA-256:** `148654765a30bb841e7b76724c90c65fbcbbc8cda853d9fad40c2ac220b523bb`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-007",
  "title": "BlackSanta: BYOVD-Based EDR Neutralization Campaign",
  "subtitle": "Observed campaign using Bring Your Own Vulnerable Driver technique to neutralize endpoint detection and response tools across enterprise environments",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, attack campaigns, and industry practices as they existed during the periods described. This Exhibit records observed attack techniques, campaign behaviors, and operational norms as documented in threat research reports and security coverage during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (2025–2026-03)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "CONTEXT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2025-01-01",
    "temporal_end": "2026-03-31"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Campaign Name: BlackSanta (internal module name found in malware code). Primary Technique: Bring Your Own Vulnerable Driver (BYOVD). Campaign Duration: Approximately one year. Operational before March 2026 disclosure. Largely unnoticed throughout.",
        "Target Profile: HR departments and recruitment workflows. Spear phishing via resume lures. Initial Vector: Spear phishing email with ISO file presented as candidate resume. ISO contains PDF link, PowerShell script, image file, icon file.",
        "Steganography Stage: PNG file contains hidden payload extracted via least significant bit (LSB) steganography. Decoded to PowerShell executed in memory via Invoke-Expression.",
        "BYOVD Mechanism: Loads legitimately signed, exploitable kernel drivers (RogueKiller AntiRootkit driver v3.1.0; IObitUnlocker.sys v1.2.0.1) to gain kernel-level access.",
        "EDR Neutralization: BlackSanta module enumerates running processes against hardcoded list of AV and EDR executables. Retrieves process ID and uses loaded drivers to unlock and terminate at kernel level, bypassing standard protections.",
        "Controls Disabled: Antivirus processes terminated. EDR agents shut down. Microsoft Defender protections weakened. System logging suppressed. Visibility removed from security consoles.",
        "Dashboard State During Attack: Endpoint health dashboards reported normal status while EDR protection was eliminated at kernel level.",
        "Post-Neutralization Activity: Credential harvesting. System reconnaissance. Data exfiltration via encrypted HTTPS channels. Cryptocurrency artifact collection.",
        "Detection Difficulty: Signed drivers evade signature-based detection. Kernel-level operation bypasses endpoint protection hooks. Campaign operated undetected for approximately one year.",
        "Discovering Organization: Aryaka Threat Research Labs (VP of Security Engineering: Aditya K Sood). Disclosure Date: March 2026.",
        "SecurityWeek Assessment: 'It is not opportunistic malware. It is operationally disciplined intrusion engineering.'"
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "BlackSanta does not attempt permanent concealment. It removes visibility first, then operates in the cleared environment. The sequence: disable defenses at kernel level, suppress logging, harvest data, exfiltrate under encryption.",
        "The endpoint protection tools were deployed and reported healthy status throughout the campaign. The control function those tools represented had been eliminated at the kernel layer. The institution continued operating under the assumption that endpoint protection existed because the tools were installed.",
        "The BYOVD technique exploits the trust delegation model of signed kernel drivers as designed. The drivers are legitimate. The signatures are valid. The kernel loads them because that is what the kernel is designed to do. The governance failure is not in the driver signing process; it is in the absence of independent verification that loaded drivers are performing the function they represent.",
        "Campaign targeting of HR workflows reflects deliberate selection of a high-trust, low-scrutiny process. Recruitment attachments are expected; recipients are conditioned to open them. The attack surface is organizational behavior, not a technical misconfiguration."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-ED-2026-009 — Evidence Docket: Update Channels as Ungoverned Trust Execution Surfaces.",
        "CHQ-ED-2026-011 — Evidence Docket: Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No evaluative judgment is made about any organization, vendor, or security posture.\n\nTemporal scope: operational period approximately 2025 through March 2026 disclosure. Exact start date unconfirmed; campaign described as active for approximately one year prior to discovery.\n\nSource: Aryaka Threat Research Labs report, March 2026. Corroborating coverage: SecurityWeek, Xcitium ThreatLabs, SecurityBrief, GlobalSecurityMag.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-03-14"
}
```