CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

UAT-10027 Campaign Targets U.S. Education and Healthcare with Dohdoor Backdoor

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A previously undocumented threat activity cluster, tracked as UAT-10027, has been targeting U.S. education and healthcare sectors since at least December 2025. The campaign delivers a new backdoor named Dohdoor, which uses DNS-over-HTTPS (DoH) for command-and-control (C2) communications. The initial access vector is suspected to involve social engineering phishing techniques, leading to the execution of a PowerShell script that downloads and runs a malicious DLL. The backdoor is launched via DLL side-loading using legitimate Windows executables. The threat actor hides C2 servers behind Cloudflare infrastructure to evade detection. Dohdoor also unhooks system calls to bypass endpoint detection and response (EDR) solutions. While there are tactical similarities to Lazarus Group malware, the victimology differs from typical Lazarus targets.

Timeline

  1. 26.02.2026 17:17 1 articles · 2h ago

    UAT-10027 Campaign Targets U.S. Education and Healthcare with Dohdoor Backdoor

    A previously undocumented threat activity cluster, tracked as UAT-10027, has been targeting U.S. education and healthcare sectors since at least December 2025. The campaign delivers a new backdoor named Dohdoor, which uses DNS-over-HTTPS (DoH) for command-and-control (C2) communications. The initial access vector is suspected to involve social engineering phishing techniques, leading to the execution of a PowerShell script that downloads and runs a malicious DLL. The backdoor is launched via DLL side-loading using legitimate Windows executables. The threat actor hides C2 servers behind Cloudflare infrastructure to evade detection. Dohdoor also unhooks system calls to bypass endpoint detection and response (EDR) solutions. While there are tactical similarities to Lazarus Group malware, the victimology differs from typical Lazarus targets.

    Show sources
    Open in new tab

Information Snippets