UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor

**Executive Summary:** Cisco Talos has identified an active campaign (UAT-10027) targeting U.S. education and healthcare organizations since December 2025 that delivers a novel backdoor called Dohdoor; the malware uses DoH for C2, DLL side‑loading with legitimate executables, reflective in-memory payload execution (Cobalt Strike observed), and user-mode unhooking to evade EDR, with payloads named like "propsys.dll" and "batmeter.dll" and C2 infrastructure hidden behind Cloudflare.