# Heartbreaker: Metamorphic macOS Ransomware Decrypted

Published: 2026-10-18 · Severity: routine
Canonical: https://vorant.io/reports/70d4d97b-1d23-57a6-a9e9-966bb9fe8a5b/heartbreaker-metamorphic-macos-ransomware-decrypted

> Objective-See found a novel macOS ransomware, Heartbreaker, that uses a hardcoded AES-GCM key, letting defenders freely decrypt files despite its self-rebuilding design.

Objective-See researchers analyzed Heartbreaker, a previously unknown, AV-undetected ransomware sample for Apple Silicon Macs, uploaded to VirusTotal in May 2025 and discovered by independent researcher Megan Carney. Written in Rust, the ad hoc-signed ARM64 Mach-O binary recursively encrypts files under the victim's ~/Downloads directory using AES-256-GCM, renames them with a .heartbreaker extension, drops a ransom note on the Desktop demanding 0.003 BTC, and attempts persistence via a LaunchAgent (~/Library/LaunchAgents/com.network.startup.plist). Crucially, every file and apparently every victim is encrypted with the same hardcoded key embedded in the binary, allowing full file recovery without payment — the researchers published a working decryptor based on this flaw.

The sample's most notable feature is an attempt at metamorphism: it embeds its own Rust source code via include_str!, and on each run invokes a framework (mimicore, apparently related to the still-available 'metacore' project) that strips prior junk code, randomizes identifiers, inserts new junk functions, and recompiles itself with cargo, aiming to produce a new binary hash each generation. This process is fragile and noisy — it depends on an unavailable upstream repository and a visible Rust/Cargo installation and build workflow — and does not alter the malware's core behavior.

The authors used Heartbreaker to validate their free, open-source RansomWhere? tool, which uses Apple's Endpoint Security framework to detect rapid creation/modification of high-entropy files by untrusted processes rather than static signatures. RansomWhere? successfully detected and suspended Heartbreaker regardless of its changing binary hash, because the behavioral impact (bulk file encryption) remains constant across generations. The article assesses Heartbreaker as a low real-world threat given its narrow scope, universal recovery key, and reliance on an unavailable build dependency, but notes it is a useful case study in both metamorphic malware design and behavior-based ransomware detection on macOS.

## Mentioned in this report

- Malware: Heartbreaker, mimicore/metacore

## Detection guidance (public sample)

### Heartbreaker Ransomware LaunchAgent Persistence File Created

ATT&CK: T1543.001

Creation of the com.network.startup.plist LaunchAgent that Heartbreaker uses for persistence on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Heartbreaker Ransomware LaunchAgent Persistence File Created
description: Detects creation of a user LaunchAgent plist named com.network.startup.plist,
  the persistence mechanism used by the Heartbreaker macOS ransomware. The generic
  network/startup naming is unusual for legitimate software.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: /Library/LaunchAgents/
    TargetFilename|endswith: /com.network.startup.plist
  condition: selection
falsepositives:
- Unlikely; an internally developed agent that happens to reuse the same plist name
level: high
id: 6411204f-2b14-50ff-b274-90a42ebd3e0b
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x8A.html
```

### Files Written With .heartbreaker Extension

ATT&CK: T1486

Files created or renamed with the .heartbreaker extension, indicating Heartbreaker ransomware encrypting user files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Files Written With .heartbreaker Extension
description: Detects file creation events for files with the .heartbreaker extension
  that Heartbreaker ransomware appends after encrypting files under the user's Downloads
  directory with AES-256-GCM.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|endswith: .heartbreaker
  condition: selection
falsepositives:
- Security staff or researchers handling Heartbreaker samples or test data
level: high
id: c8ae11b7-cbcf-5494-bbb4-d6ead2d7b568
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x8A.html
```

### Cargo or Rustc Spawned by Binary in User-Writable Location on macOS

ATT&CK: T1027

A binary run from Downloads or a temp directory launching cargo or rustc, consistent with Heartbreaker's metamorphic self-recompilation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cargo or Rustc Spawned by Binary in User-Writable Location on macOS
description: Detects cargo or rustc launched by a parent executing from Downloads
  or a temp directory. Heartbreaker embeds its own Rust source, mutates it (junk code,
  renamed identifiers) and recompiles itself with cargo on each run to change its
  hash.
tags:
- attack.stealth
- attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection_child:
    Image|endswith:
    - /cargo
    - /rustc
  selection_parent:
    ParentImage|contains:
    - /Downloads/
    - /tmp/
    - /private/var/tmp/
    - /private/var/folders/
  filter_rustup:
    ParentImage|endswith:
    - /rustup
    - /cargo
  condition: selection_child and selection_parent and not filter_rustup
falsepositives:
- Developers building Rust projects from a checkout located under Downloads or a temp
  directory
- Build scripts in CI runners that use temporary working directories
level: medium
id: ad6eafd1-9495-5f16-9fb4-921f09720aa5
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x8A.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x8A.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/70d4d97b-1d23-57a6-a9e9-966bb9fe8a5b/heartbreaker-metamorphic-macos-ransomware-decrypted.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup