Henry IV, Hotspur, Hal, and hallucinations
Summary: Cisco Talos reported an ongoing campaign by UAT-10027 using a new backdoor called Dohdoor since December 2025, which leverages DNS-over-HTTPS for stealthy command-and-control and can download and execute payloads within legitimate Windows processes. The campaign targets US education and health care sectors through phishing, PowerShell scripts, and DLL sideloading, with C2 infrastructure hidden behind reputable services like Cloudflare.
Bottom line: Dohdoor's use of legitimate Windows tools and encrypted DoH communications makes detection and response challenging, and the targeting of schools and hospitals raises the stakes for disruption and data theft in sectors holding sensitive data.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026