Heartbreaker Ransomware Targets macOS Users with Self-Rebuilding Capabilities

objective-see.org

Heartbreaker Ransomware Targets macOS Users with Self-Rebuilding Capabilities

First seen 23 Oct 2026, 15:43 UTC • •42.6

Article Content

1 / 5

Browse articles

ThreatCluster •October 23, 2026 at 18:15 UTC

•Heartbreaker ransomware targets macOS users, encrypting files in the Downloads folder.
•The ransomware can rebuild itself, but uses a hardcoded AES key for encryption.
•Research indicates that Heartbreaker is unlikely to pose a significant threat currently.

Heartbreaker is a Rust-based macOS ransomware sample that was uploaded to VirusTotal in May 2025 and remains undetected by antivirus engines. It encrypts files in the user's Downloads folder and attempts to persist by setting up a LaunchAgent. The ransomware can rebuild itself by randomizing its source code and recompiling, but it uses a hardcoded AES key, allowing for potential file recovery. Researcher Patrick Wardle believes the threat is limited due to its reliance on an outdated Rust framework. The ISO/IEC has also published a standard aimed at mitigating AI threats, highlighting the evolving landscape of cybersecurity. Current assessments suggest Heartbreaker is not a major threat at this time.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2025-05-01

Heartbreaker uploaded to VirusTotal

A Rust-based macOS ransomware sample was uploaded, remaining undetected by antivirus engines.

2026-10-23

Heartbreaker analysis published

Researcher Patrick Wardle analyzed Heartbreaker, noting its self-rebuilding capabilities and limited threat.

objective-see.org

More articles in this cluster (4)

Threat Graph

7 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

APT28
Swallowtail

Technique (3)

Ransomware
T1486 - Data Encrypted for Impact
T1547 - Boot Or Logon Autostart Execution

Malware (1)

Heartbreaker

Affected Platform (1)

MacOS

Relationships

APT28 uses Heartbreaker
Swallowtail uses Heartbreaker
APT28 uses Ransomware
APT28 uses T1486 - Data Encrypted for Impact
APT28 uses T1547 - Boot Or Logon Autostart Execution
Swallowtail uses Ransomware
Swallowtail uses T1486 - Data Encrypted for Impact
Swallowtail uses T1547 - Boot Or Logon Autostart Execution
APT28 related to MacOS

Following this threat?

Track APT28 and Heartbreaker in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

How does Heartbreaker operate?

Heartbreaker encrypts files in the Downloads folder and can rebuild itself from its source code.

Is there a way to recover files encrypted by Heartbreaker?

Yes, due to its use of a hardcoded AES key, file recovery is possible.

What should macOS users do to protect against Heartbreaker?

Users should ensure their antivirus software is updated and remain vigilant against suspicious file activity.

Continue Reading

APT28 Targets NATO Defense Firms with New Hookedge Backdoor The Russian espionage group APT28, also known as Swallowtail, has targeted defense contractors in two NATO countries, including a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. The attacks utilized a new backdoor called Hookedge, which was first documented in August 2026.…

Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…