HeartCrypts
HeartCrypt’s wholesale impersonation effort
Over the past year and a bit more, we’ve monitored a constellation of events that share a set of general attributes: Malware impersonating, subverting, and embedding itself in legitimate software applications Position-independent loader code (PIC) injected near package entry points, overwriting the original code Encrypted malicious payloads inserted as an additional resource Use of a…