Threat intelligence / Malware

HeartCrypt

[HeartCrypt](https://attack.mitre.org/software/S9018) is a packer-as-a-service (PaaS) used to protect malware that has been available since at least 2024. [HeartCrypt](https://attack.mitre.org/software/S9018) has been used to pack a variety of malware including [Lumma Stealer](https://attack.mitre.org/software/S1213), [Remcos](https://attack.mitre.org/software/S0332), and Rhadamanthys. In the [HeartCrypt](https://attack.mitre.org/software/S9018) PaaS model, customers submit malware via private messaging services and it is then packed and returned by the operator as a new binary.(Citation: Palo Alto HeartCrypt DEC 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HeartCrypt](https://attack.mitre.org/software/S9018) is a packer-as-a-service (PaaS) used to protect malware that has been available since at least 2024. [HeartCrypt](https://attack.mitre.org/software/S9018) has been used to pack a variety of malware including [Lumma Stealer](https://attack.mitre.org/software/S1213), [Remcos](https://attack.mitre.org/software/S0332), and Rhadamanthys. In the [HeartCrypt](https://attack.mitre.org/software/S9018) PaaS model, customers submit malware via private messaging services and it is then packed and returned by the operator as a new binary.(Citation: Palo Alto HeartCrypt DEC 2024)

Labels

malware

12 recorded

Relationships

uses

Group

uses

to Asynchronous Procedure Call

Technique

uses

to Binary Padding

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Masquerade File Type

Technique

uses

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Software Packing

Technique

uses

to System Checks

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S9018

Palo Alto HeartCrypt DEC 2024

https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/