MITRE ATT&CKsoftware (malware)
S9018 HeartCrypt
- Domain
- enterprise
- Platforms
- Linux, Windows
- Version
- 1.0
- Created
- 2026-04-16
Description
HeartCrypt is a packer-as-a-service (PaaS) used to protect malware that has been available since at least 2024. HeartCrypt has been used to pack a variety of malware including Lumma Stealer, Remcos, and Rhadamanthys. In the HeartCrypt PaaS model, customers submit malware via private messaging services and it is then packed and returned by the operator as a new binary.
Related
Uses · MITRE ATT&CK (11)
- T1027.013 Encrypted/Encoded File sub-technique
- T1036.008 Masquerade File Type sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1027.001 Binary Padding sub-technique
- T1027.002 Software Packing sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.004 Asynchronous Procedure Call sub-technique
- T1055.012 Process Hollowing sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G0099 APT-C-36 group
References
- https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/ Palo Alto HeartCrypt DEC 2024