Heartbreaker: Metamorphic macOS Ransomware Decrypted

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Objective-See found a novel macOS ransomware, Heartbreaker, that uses a hardcoded AES-GCM key, letting defenders freely decrypt files despite its self-rebuilding design.

Objective-See researchers analyzed Heartbreaker, a previously unknown, AV-undetected ransomware sample for Apple Silicon Macs, uploaded to VirusTotal in May 2025 and discovered by independent researcher Megan Carney. Written in Rust, the ad hoc-signed ARM64 Mach-O binary recursively encrypts files under the victim's ~/Downloads directory using AES-256-GCM, renames them with a .heartbreaker extension, drops a ransom note on the Desktop demanding 0.003 BTC, and attempts persistence via a LaunchAgent (~/Library/LaunchAgents/com.network.startup.plist). Crucially, every file and apparently every victim is encrypted with the same hardcoded key embedded in the binary, allowing full file recovery without payment — the researchers published a working decryptor based on this flaw.

The sample's most notable feature is an attempt at metamorphism: it embeds its own Rust source code via include_str!, and on each run invokes a framework (mimicore, apparently related to the still-available 'metacore' project) that strips prior junk code, randomizes identifiers, inserts new junk functions, and recompiles itself with cargo, aiming to produce a new binary hash each generation. This process is fragile and noisy — it depends on an unavailable upstream repository and a visible Rust/Cargo installation and build workflow — and does not alter the malware's core behavior.

The authors used Heartbreaker to validate their free, open-source RansomWhere? tool, which uses Apple's Endpoint Security framework to detect rapid creation/modification of high-entropy files by untrusted processes rather than static signatures. RansomWhere? successfully detected and suspended Heartbreaker regardless of its changing binary hash, because the behavioral impact (bulk file encryption) remains constant across generations. The article assesses Heartbreaker as a low real-world threat given its narrow scope, universal recovery key, and reliance on an unavailable build dependency, but notes it is a useful case study in both metamorphic malware design and behavior-based ransomware detection on macOS.

title: Heartbreaker Ransomware LaunchAgent Persistence File Created
description: Detects creation of a user LaunchAgent plist named com.network.startup.plist,
  the persistence mechanism used by the Heartbreaker macOS ransomware. The generic
  network/startup naming is unusual for legitimate software.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: /Library/LaunchAgents/
    TargetFilename|endswith: /com.network.startup.plist
  condition: selection
falsepositives:
- Unlikely; an internally developed agent that happens to reuse the same plist name
level: high
id: 6411204f-2b14-50ff-b274-90a42ebd3e0b
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x8A.html

title: Files Written With .heartbreaker Extension
description: Detects file creation events for files with the .heartbreaker extension
  that Heartbreaker ransomware appends after encrypting files under the user's Downloads
  directory with AES-256-GCM.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|endswith: .heartbreaker
  condition: selection
falsepositives:
- Security staff or researchers handling Heartbreaker samples or test data
level: high
id: c8ae11b7-cbcf-5494-bbb4-d6ead2d7b568
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x8A.html

title: Cargo or Rustc Spawned by Binary in User-Writable Location on macOS
description: Detects cargo or rustc launched by a parent executing from Downloads
  or a temp directory. Heartbreaker embeds its own Rust source, mutates it (junk code,
  renamed identifiers) and recompiles itself with cargo on each run to change its
  hash.
tags:
- attack.stealth
- attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection_child:
    Image|endswith:
    - /cargo
    - /rustc
  selection_parent:
    ParentImage|contains:
    - /Downloads/
    - /tmp/
    - /private/var/tmp/
    - /private/var/folders/
  filter_rustup:
    ParentImage|endswith:
    - /rustup
    - /cargo
  condition: selection_child and selection_parent and not filter_rustup
falsepositives:
- Developers building Rust projects from a checkout located under Downloads or a temp
  directory
- Build scripts in CI runners that use temporary working directories
level: medium
id: ad6eafd1-9495-5f16-9fb4-921f09720aa5
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x8A.html

Source reporting: https://objective-see.org/blog/blog_0x8A.html