Dohdoor: New Stealth Backdoor Targets US Healthcare and Education

Cisco Talos researchers uncovered an ongoing, sophisticated espionage campaign (UAT-10027) deploying a novel DoH-based backdoor named "Dohdoor" that targets U.S. education and healthcare; the attack chain uses phishing to execute PowerShell and batch scripts, sideloads a malicious DLL (eg. "propsys.dll") into trusted applications, and leverages advanced evasion (Cloudflare DoH C2, process hollowing, NTDLL unhooking, reflective payload loading), with tradecraft similar to known North Korean APTs.