New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain
## Cybersecurity: Dohdoor Malware Campaign Targeting U.S. Sectors
Cybersecurity: Dohdoor Malware Campaign Targeting U.S. Sectors
A recent malware campaign has been identified as targeting educational and healthcare organizations across the United States since December 2025.
The threat, designated as "UAT-10027," employs a previously unknown backdoor named "Dohdoor," utilizing advanced stealth techniques and a multi-stage delivery method to establish persistent access within targeted environments.
This emergence indicates a shift towards targeting sectors that handle sensitive personal data often with limited security resources.
Dohdoor utilizes the DNS-over-HTTPS (DoH) method to communicate with its command-and-control (C2) servers, turning a trusted internet protocol into a covert channel. The malware routes C2 traffic through Cloudflare's encrypted DNS infrastructure, masking its communications as regular HTTPS traffic.
The malware employs subdomain names such as "MswInSofTUpDloAd" to mimic legitimate software update requests. Irregular capitalization in non-standard top-level domains, such as ".OnLiNe" and ".DeSigN," helps bypass automated filters and blocklists.
A recent malware campaign has been identified as targeting educational and healthcare organizations across the United States since December 2025.
Cisco Talos analysts attributed this campaign to UAT-10027, noting the misuse of legitimate Windows executables, or living-off-the-land binaries (LOLBins), to sideload the Dohdoor malware.
The infection begins with phishing emails that deliver a PowerShell script to the victim's machine, executing a sequence of actions:
The script uses curl.exe with an encoded URL to download a malicious Windows batch file. The batch script creates a hidden working folder, downloads a malicious DLL, and uses legitimate Windows executables for DLL sideloading. After execution, the script performs an anti-forensic cleanup by deleting its traces.
Once active, Dohdoor resolves the C2 server's IP using encrypted DNS queries over HTTPS and downloads an encrypted payload, which is decrypted using a custom algorithm and injected into legitimate Windows processes via process hollowing.
Dohdoor evades endpoint detection tools by patching system call stubs, removing monitoring hooks. Evidence suggests the final payload may be a Cobalt Strike Beacon.
Organizations in the education and healthcare sectors are advised to block suspicious LOLBin activity, monitor HTTPS traffic, and implement DNS security controls. Applying specific ClamAV signatures and Snort rules can assist in detecting and blocking this threat.
Based on reporting by Cyber Security News.