Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Crypted Hearts: Exposing the Heart Crypt Packer-as-a-Service Operation

Summary: Unit 42 documented HeartCrypt, a packer-as-a-service in development since July 2023 that began selling around February 17, 2024 at $20 per file to pack Windows x86 and .NET payloads. Over its eight months of operation it packed more than 2,000 malicious payloads across roughly 45 malware families, with customers including operators of LummaStealer, Remcos and Rhadamanthys.

Bottom line: A $20-per-file service that wraps malware inside legitimate binaries - drawn from over 300 carrier executables - lets even low-skilled operators produce samples that defeat static and dynamic analysis, and Unit 42 found HeartCrypt adopted a Defender-emulation evasion technique just 15 days after it was first publicly reported.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026