New Dohdoor malware campaign targets education and health care

A malicious campaign by threat actor UAT-10027 has been targeting education and healthcare sectors in the United States since December 2025. The campaign utilizes a new backdoor called Dohdoor, which employs DNS-over-HTTPS for stealthy command-and-control communications and can download and execute payloads reflectively. The multi-stage attack chain likely begins with phishing emails, followed by PowerShell scripts, batch files, and DLL sideloading techniques. Dohdoor uses various evasion methods, including API obfuscation, encrypted communications, and EDR bypasses. The campaign's infrastructure leverages Cloudflare services for stealth. While some techniques overlap with North Korean APT groups, the targeting differs from their typical focus.

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• ValleyRAT is spreading disguised as adwareMalware2026-08-31
• C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2Malware2026-08-17
• Camera Management Software Compromise Leads to Malware DeploymentMalware2026-10-27
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16