Excerpt
Thursday, February 26, 2026 06:00
Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for command-and-control (C2) communications and has the ability to download and execute other payload binaries reflectively.
UAT-10027 targeted victims in the education and health care sectors in the United States through a multi-stage attack chain. Talos observed the actor misused various living-off-the-land executables (LOLBins) to sideload the Dohdoor and ha…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Cisco Talos on blog.talosintelligence.com.
Mentioned in the excerpt
More from Cisco Talos7
- The Closed Quorum: Inside the first reported autonomous AI C2 implantCisco Talos · Published 22 Sep
- UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignCisco Talos · Published 16 Jul
- UAT-7810 continues building ORB networks using new malwareCisco Talos · Published 7 Jul
- UAT-8302 and its box full of malwareCisco Talos · Published 5 May
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
