Loading malware…
Dohdoor is a previously unseen Windows backdoor/loader reported by Cisco Talos in an ongoing campaign active since at least December 2025. Talos tracks the associated threat cluster as UAT-10027. The campaign primarily targeted U.S. education and healthcare organizations, including multiple educational institutions and at least one elderly-care healthcare facility. Initial access is assessed to likely involve social-engineering phishing that triggers a PowerShell script, which downloads a batch script and then stages a malicious DLL such as propsys.dll or batmeter.dll. The malware is executed via DLL sideloading using legitimate Microsoft-signed or Windows executables including Fondue.exe, mblctr.exe, and ScreenClippingHost.exe.
Dohdoor is described as a 64-bit DLL loader compiled on 2025-11-25, with a reported debug path string of C:\Users\diablo\Desktop\SimpleDll\TlsClient.hpp. It dynamically resolves Windows APIs by hash, downloads encrypted payloads, decrypts them with a custom XOR-SUB routine, and executes them in memory inside legitimate Windows processes. Reported target processes for process hollowing include OpenWith.exe, wksprt.exe, ImagingDevices.exe, and wab.exe. Talos also reported EDR-evasion behavior including checking for user-mode hooks in ntdll.dll and patching syscall stubs such as NtProtectVirtualMemory to bypass monitoring.
A defining feature of Dohdoor is its use of DNS-over-HTTPS for command-and-control discovery. It sends encrypted DNS requests over HTTPS, including to Cloudflare public DoH infrastructure over port 443, parses JSON DNS responses to obtain C2 IP addresses, and then issues follow-on HTTPS GET requests to the resolved infrastructure. Reported request characteristics include the Accept header application/dns-json, spoofed User-Agent strings such as insomnia/11.3.0, curl/7.88, and curl/7.83.1, and observed path patterns including /X111111?sub=s and /111111?sub=d. Talos reported deceptive subdomains such as MswInSofTUpDloAd and DEEPinSPeCTioNsyStEM, along with irregularly capitalized TLDs including .OnLiNe, .DeSigN, and .SoFTWARe.
The infection chain also included anti-forensic actions by the batch stage, such as creating hidden folders under C:\ProgramData or C:\Users\Public, clearing RunMRU history, wiping clipboard data, and deleting itself. Dohdoor can download and execute additional payloads reflectively; Talos reported telemetry and OSINT suggesting a likely follow-on Cobalt Strike Beacon, though the final payload was not definitively recovered. Reported network indicators include JA3S fingerprint 466556e923186364e82cbdb4cad8df2c and TLS certificate serial 7FF31977972C224A76155D13B6D685E3. Detection coverage mentioned in the content includes ClamAV signatures Win.Loader.Dohdoor-10059347-0, Win.Loader.Dohdoor-10059535-0, Ps1.Loader.Dohdoor-10059533-0, and Ps1.Loader.Dohdoor-10059534-0, as well as Snort SIDs 65949, 65950, 65951, and 301407.
Cisco Talos assessed with low confidence that UAT-10027 may have a North Korea nexus due to tradecraft overlaps and similarities between Dohdoor and Lazarloader, but attribution remains unconfirmed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In December 2025, a hacking crew found a way to whisper that question instead of saying it out loud. Their backdoor, named Dohdoor, doesn’t phone a shady server directly. It simply asks Cloudflare...
"...the multi-stage infection ultimately delivers a new backdoor, Dohdoor..."; "The DLL, which Talos calls 'Dohdoor,' operates as a loader, and it downloads, decrypts, and executes malicious payloads within legitimate Windows processes."
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The loader DLL ... decrypts its payload with a custom XOR-SUB routine ( decrypted[i] = encrypted[i*4] - i - 0x26 ).
Those scripts created hidden folders and downloaded a malicious component named to impersonate real Windows files — propsys.dll and batmeter.dll.
The loader DLL ... uses process hollowing to run inside a legitimate process.
“…deleting the Run command history from the RunMRU registry key, clearing clipboard data, and deleting itself entirely — a tactic known as anti-forensic cleanup.”
Dohdoor ... download, decrypt, and run payloads... It decrypts the payload with a custom XOR-SUB algorithm...
“…misuses legitimate Windows executables, known as living-off-the-land binaries (LOLBins), to sideload the Dohdoor malware… Legitimate Windows executables such as Fondue.exe, mblctr.exe, and ScreenClippingHost.exe… used to sideload and execute the malicious DLL…”
Dohdoor sends an encrypted DNS lookup to Cloudflare’s public DoH service, over the same secure port (443) every website uses.
It hides its lookups using DNS-over-HTTPS ... It asks for the standard records that map a name to a number — A records ... and AAAA records ... Inside that answer is the real address of the command server.
"The threat actor hides the C2 servers behind the Cloudflare infrastructure... outbound communication ... appears as legitimate HTTPS traffic"
...set up the C2 infrastructure behind reputable cloud services such as Cloudflare for stealth communication.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/loader that uses DNS-over-HTTPS via Cloudflare to resolve its real C2, employs DLL sideloading, API hashing, custom decryption, ntdll unhooking, and process hollowing, and can execute additional payloads in memory.
Backdoor using DNS-over-HTTPS for C2, with capability to download and execute additional payloads reflectively; observed in campaigns where Cobalt Strike Beacon appeared as a follow-on payload.
Backdoor that uses DNS-over-HTTPS for C2 and can reflectively download and execute additional payloads; observed in campaigns where Cobalt Strike Beacon was also used for follow-on access.
Malware family referenced as part of a campaign targeting education and healthcare sectors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.