New Dohdoor malware campaign targets education and health care
Summary: Cisco Talos discovered a multi-stage campaign, tracked as UAT-10027, targeting education and health care organizations predominantly in the United States, with initial access likely gained through social engineering phishing that runs a PowerShell script to download a batch script from a remote staging server. The chain sideloads a 64-bit DLL called Dohdoor, compiled Nov. 25, 2025, which resolves command-and-control domains via DNS-over-HTTPS through Cloudflare, tunnels HTTPS traffic to infrastructure fronted by Cloudflare, and injects payloads into legitimate Windows processes using process hollowing. Talos assesses with low confidence that UAT-10027 is North Korea-nexus, citing shared TTPs with Lazarus, including XOR-SUB position-dependent decryption with the constant 0x26 and ntdll syscall unhooking.
Key Takeaway: The C2 traffic leaves victim machines as ordinary HTTPS to a trusted Cloudflare IP address, using subdomains like "MswInSofTUpDloAd" and irregular TLD capitalization, so DNS sinkholes, string-matching filters and blocklists built for plaintext lookups and single domains will not see it. Talos could not recover the implanted payload, but a C2 host's JA3S hash and TLS certificate serial number resemble a default Cobalt Strike server, pointing to a beacon already positioned for follow-on execution inside education and health care networks.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026