Suspected Nork digital intruders caught breaking into US healthcare, education orgs

Cisco Talos identified an ongoing campaign (since at least December) delivering a new loader/backdoor named Dohdoor that sideloads malicious DLLs (e.g., propsys.dll), downloads and executes additional payloads (including Cobalt Strike), and employs evasive techniques such as process hollowing, ntdll unhooking to bypass EDR, and DNS-over-HTTPS via Cloudflare for C2 resolution; observed victims include educational institutions and an elderly-care healthcare facility. Talos tracks the cluster as UAT-10027 and notes technical overlaps with Lazarus Group tooling but assigns low confidence to North Korean attribution.