Dohdoor Malware Targets U.S. Schools and Healthcare with Multi-Stage Attack

A multi-stage campaign (UAT-10027) is actively deploying the Dohdoor backdoor against U.S. schools and healthcare providers to establish persistent access and stage Cobalt Strike beacons; the malware uses phishing-triggered PowerShell downloaders, DLL sideloading of malicious DLLs via trusted binaries, process hollowing, DoH-based C2 over Cloudflare, and advanced EDR-evasion techniques, with telemetry and IoCs provided and a low-confidence link to Lazarus.