UAT-10027 is a newly identified threat actor targeting U.S. education and healthcare sectors in a campaign active since at least December 2025. According to technical reports from Cisco Talos, the primary payload is a novel backdoor called Dohdoor.

Key Details of the Campaign

• Malware Mechanism: Dohdoor utilizes DNS-over-HTTPS (DoH) for its command-and-control (C2) communications, making the traffic harder to detect as it blends with legitimate web traffic.
• Capabilities: The backdoor can reflectively download and execute additional binaries and unhook system calls to bypass Endpoint Detection and Response (EDR) solutions.
• Infection Vector: While not fully confirmed, researchers suspect social engineering phishing leads to the execution of a PowerShell script, which then triggers the infection chain.
• Attribution: There is no definitive link to a known group, but Cisco Talos noted technical similarities to Lazarloader, a tool used by the North Korean group Lazarus. However, the victim profile (education/healthcare) differs from Lazarus’s usual focus on cryptocurrency.