UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor
An continuous malicious effort targeting the U.S. healthcare and education sectors since at least December 2025 has been linked to a threat activity cluster that was previously unreported.
Cisco Talos is monitoring the campaign with the code UAT-10027. Delivering a previously unseen backdoor dubbed Dohdoor is the ultimate objective of the attacks.
Security researchers Alex Karkins and Chetan Raghuprasad stated in a technical paper posted with The Hacker News that Dohdoor uses the DNS-over-HTTPS (DoH) mechanism for command-and-control (C2) communications and can download and execute other payload programs reflectively.
Although the campaign's original access vector is still unknown, it is believed to have involved the use of social engineering phishing tactics that resulted in the...