Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 14:43:40 UTC Home > List all groups > List all tools > List all groups using tool STEELHOUND Tool: STEELHOUND Names STEELHOUND Category Malware Type Dropper Description (Mandiant) Mandiant discovered UNC2891 leveraging a similar (STEELCORGI) in-memory dropper that also used environment variables to decrypt its embedded payload but instead relied on RC4 encryption, we have named this STEELHOUND. In addition to functioning as dropper for an embedded payload, STEELHOUND is also able to encrypt new payloads by encrypting a target binary and writing it to disk along with a copy of itself and an end-of-file configuration. Information Last change to this tool card: 03 April 2022 Download this tool card in JSON format All groups using tool STEELHOUND Changed Name Country Observed APT groups   UNC2891 [Unknown] 2020   1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=7ba6ed83-c174-4edc-8e35-1a8ad536b511 https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=7ba6ed83-c174-4edc-8e35-1a8ad536b511 Page 1 of 1