{"id":11013,"date":"2026-02-28T10:03:36","date_gmt":"2026-02-28T10:03:36","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/28\/new-dohdoor-malware-attacking-schools-and-health-care-sectors-in-u-s-via-multi-stage-attack-chain\/"},"modified":"2026-02-28T10:03:36","modified_gmt":"2026-02-28T10:03:36","slug":"new-dohdoor-malware-attacking-schools-and-health-care-sectors-in-u-s-via-multi-stage-attack-chain","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/28\/new-dohdoor-malware-attacking-schools-and-health-care-sectors-in-u-s-via-multi-stage-attack-chain\/","title":{"rendered":"New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain"},"content":{"rendered":"

New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly discovered malware campaign has been quietly targeting educational institutions and healthcare organizations across the United States since at least December 2025. <\/p>\n

The threat, tracked under the actor designation \u201cUAT-10027,\u201d deploys a previously unknown backdoor called \u201cDohdoor,\u201d which uses an advanced combination of stealth techniques and multi-stage delivery to gain persistent access into victim environments. <\/p>\n

The malware\u2019s emergence signals a growing trend of sophisticated threat actors shifting their focus toward sectors that handle sensitive personal data but often operate with limited security resources.\u200b<\/p>\n

Dohdoor takes its name partly from the DNS-over-HTTPS (DoH) technique it uses to communicate with its command-and-control (C2) servers \u2014 a method that turns a trusted internet protocol into a covert communications channel. <\/p>\n

By routing its C2 traffic through Cloudflare\u2019s encrypted DNS infrastructure<\/a>, the malware makes outbound communications appear as normal HTTPS traffic, blending in with everyday network activity. <\/p>\n

The threat actor further reinforces this deception by using subdomain names like \u201cMswInSofTUpDloAd\u201d and \u201cDEEPinSPeCTioNsyStEM\u201d to mimic legitimate software update requests or security check-ins. <\/p>\n

Irregular capitalization across non-standard top-level domains \u2014 such as \u201c.OnLiNe,\u201d \u201c.DeSigN,\u201d and \u201c.SoFTWARe\u201d \u2014 helps the campaign bypass automated string-matching filters and blocklist defenses.\u200b<\/p>\n

Cisco Talos analysts identified<\/a> this ongoing campaign and attributed it to UAT-10027, noting that the threat actor misuses legitimate Windows executables, known as living-off-the-land binaries (LOLBins), to sideload the Dohdoor malware into compromised systems. <\/p>\n

Researchers noted that the campaign\u2019s infrastructure is carefully designed to avoid attribution, with C2 servers hidden behind Cloudflare\u2019s globally trusted edge network, making traffic interception and blocking significantly harder for defenders. <\/p>\n

The campaign was first detected through suspicious download telemetry observed by Talos, linking it to a broader pattern of targeted intrusions in the education and healthcare sectors.\u200b<\/p>\n

The initial point of entry is believed to involve phishing emails<\/a> that deliver a PowerShell script to the victim\u2019s machine. <\/p>\n

Once executed, this script uses\u00a0curl.exe<\/code>\u00a0with an encoded URL to download a malicious Windows batch file \u2014 either a\u00a0.bat<\/code>\u00a0or\u00a0.cmd<\/code>\u00a0file \u2014 from a remote staging server.<\/p>\n

\n
\"Attack
Attack chain (Source \u2013 Cisco Talos) <\/figcaption><\/figure>\n<\/div>\n

This sets off a carefully sequenced infection process where each stage paves the way for the next, minimizing the malware\u2019s footprint at any single point in time.<\/p>\n

Inside the Multi-Stage Infection Mechanism<\/h2>\n

The batch script \u2014 the second stage of the attack chain \u2014 acts as both a dropper and a cleanup tool. <\/p>\n

It first creates a hidden working folder in either\u00a0C:ProgramData<\/code>\u00a0or\u00a0C:UsersPublic<\/code>, then downloads a malicious DLL from the C2 server, disguising it under legitimate-sounding names like\u00a0propsys.dll<\/code>\u00a0or\u00a0batmeter.dll<\/code>.<\/p>\n

\n
\"Deobfuscated
Deobfuscated Windows batch loader script (C2 URLs defanged) (Source \u2013 Cisco Talos) <\/figcaption><\/figure>\n<\/div>\n

Legitimate Windows executables such as\u00a0Fondue.exe<\/code>,\u00a0mblctr.exe<\/code>, and\u00a0ScreenClippingHost.exe<\/code>\u00a0are then copied into this working folder and used to sideload and execute the malicious DLL through a technique called DLL sideloading<\/a>. <\/p>\n

After the malware is running, the batch script erases its own tracks by deleting the Run command history from the\u00a0RunMRU<\/code>\u00a0registry key, clearing clipboard data, and deleting itself entirely \u2014 a tactic known as anti-forensic cleanup.\u200b<\/p>\n

Once Dohdoor is active, it resolves the C2 server\u2019s IP address using encrypted DNS queries sent over HTTPS port 443, receiving JSON responses that it parses to extract the IP data.<\/p>\n

\n
\"Snippet
Snippet of Dohdoor showing the DoH technique (Source \u2013 Cisco Talos) <\/figcaption><\/figure>\n<\/div>\n

It then downloads an encrypted payload, which is decrypted using a custom XOR-SUB algorithm with a position-dependent cipher before being injected into legitimate Windows processes like\u00a0OpenWith.exe<\/code>\u00a0and\u00a0wab.exe<\/code>\u00a0via process hollowing. <\/p>\n

\n
\"Snippet
Snippet of Dohdoor showing the position dependent decryption algorithm (Source \u2013 Cisco Talos)<\/figcaption><\/figure>\n<\/div>\n

To evade endpoint detection and response (EDR) tools, Dohdoor patches system call stubs in\u00a0ntdll.dll<\/code>, effectively removing the monitoring hooks that security products rely on. <\/p>\n

\n
\"Dohdoor
Dohdoor function showing the syscall unhooking EDR bypass technique (Source \u2013 Cisco Talos)<\/figcaption><\/figure>\n<\/div>\n

Evidence suggests the final payload is likely a Cobalt Strike Beacon<\/a>, based on matching JA3S hash signatures found in the C2 infrastructure.\u200b<\/p>\n

Talos assesses with low confidence that UAT-10027 may have ties to North Korea\u2019s Lazarus Group, citing overlapping decryption techniques, NTDLL unhooking methods, and domain naming patterns. <\/p>\n

Organizations in the education and healthcare sectors are strongly advised to block suspicious LOLBin activity, monitor for anomalous HTTPS traffic, and implement DNS security controls capable of inspecting DoH traffic. <\/p>\n

Applying ClamAV signatures\u00a0Win.Loader.Dohdoor-10059347-0<\/code>,\u00a0Win.Loader.Dohdoor-10059535-0<\/code>,\u00a0Ps1.Loader.Dohdoor-10059533-0<\/code>, and\u00a0Ps1.Loader.Dohdoor-10059534-0<\/code>, along with Snort rules SIDs 65949\u201365951 (Snort 2) and 301407, 65949 (Snort 3), can help detect and block this threat.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain A newly discovered malware campaign has been quietly targeting educational institutions and healthcare organizations across the United States since at least December 2025. The threat, tracked under the actor designation \u201cUAT-10027,\u201d deploys a previously unknown backdoor called \u201cDohdoor,\u201d which uses […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-11013","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11013"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11013"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11013\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}