New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain

**Executive summary:** A sophisticated multi-stage malware campaign named "Dohdoor" (attributed to actor UAT-10027) has been targeting U.S. education and healthcare organizations since at least December 2025; it uses phishing-delivered PowerShell, DLL sideloading via living-off-the-land binaries, DoH-based C2 over Cloudflare, position-dependent payload decryption, process hollowing, and ntdll syscall unhooking to maintain persistence and evade EDR, and the report provides IoCs and detection signatures for defenders.