HellHounds
HellHounds is a threat actor group, tracked by Brandefense. It targets 4 sectors, including Government and Technology, in Russia. It uses 4 MITRE ATT&CK techniques.
- Techniques
- 4
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2019
- Last seen
- May 23, 2024
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
4 techniques across 3 of 14 tacticsArsenal · Malware And Tools.
- 3snakemalware
- Decoy Dog RATmalware
- Slivertool
Campaigns.
- Operation LahatDec 2021 to May 2024
About HellHounds.
Hellhounds is an APT group targeting organizations in Russia, using a modified version of Pupy RAT called Decoy Dog. They gain initial access through vulnerable web services and trusted relationships, with a focus on the public sector and IT companies.
The group has been active since at least 2019, maintaining covert presence inside compromised organizations by modifying open-source projects to evade detection. Hellhounds have successfully targeted at least 48 victims, including a telecom operator where they disrupted services.
Last updated Nov 10, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.