Loading story…
Cisco Talos reported an ongoing intrusion campaign, tracked as UAT-10027, targeting U.S. education and healthcare organizations since at least December 2025 to deploy a previously undocumented backdoor dubbed Dohdoor. The activity is assessed to begin with likely social-engineering/phishing that leads to execution of a PowerShell script, which then pulls a Windows batch script from a remote staging server; the batch script downloads a malicious DLL (reported as propsys.dll or batmeter.dll) and executes it via DLL side-loading using legitimate Windows executables (e.g., Fondue.exe, mblctr.exe, ScreenClippingHost.exe) and other living-off-the-land binaries (LOLBins).
Once running, Dohdoor uses DNS-over-HTTPS (DoH) for command-and-control and can reflectively download and execute additional payloads. Talos assessed that the backdoor is used to retrieve a next-stage payload directly into memory, including a Cobalt Strike Beacon, while the operator obscures C2 by placing infrastructure behind reputable services such as Cloudflare—making outbound traffic appear as legitimate HTTPS to trusted IP space and reducing the effectiveness of DNS-based detections, sinkholing, and domain-lookup monitoring.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On February 26, 2026, Cisco Talos published research on the ongoing UAT-10027 campaign, detailing Dohdoor's use of DNS-over-HTTPS through Cloudflare, EDR bypass via NTDLL unhooking, and anti-forensic behavior. Talos also released detection coverage including ClamAV signatures, Snort rules, and IOCs through a GitHub repository.
In its investigation, Cisco Talos found telemetry and OSINT indicators suggesting the final payload may be a Cobalt Strike Beacon. Talos also assessed with low confidence that UAT-10027 may have North Korea nexus due to tradecraft overlaps with Lazarus tooling such as Lazarloader, while noting the victimology differs from typical Lazarus targeting.
The campaign uses likely phishing or social-engineering for initial access, followed by PowerShell and batch-script stages that sideload malicious DLLs through legitimate Windows binaries. The previously undisclosed Windows backdoor/loader, Dohdoor, then downloads and decrypts follow-on payloads and executes them in memory via process hollowing.
Cisco Talos said the malicious campaign tracked as UAT-10027 has been active since at least December 2025, primarily targeting U.S. education and healthcare organizations. Reported victims include multiple educational institutions and at least one healthcare or elderly-care facility.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcego.theregister.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Rapid7 reported multiple intrusions tied to an ongoing social-engineering campaign that starts with email bombing and follow-up calls, often over Microsoft Teams, to pressure users into installing **AnyDesk**. In the observed June 2024 cases, the operators moved away from earlier Quick Assist and batch-script tradecraft and instead used a signed .NET credential harvester, `AntiSpam.exe`, followed by payloads masquerading as software updates. Those payloads included **SystemBC**, Golang HTTP beacons, SOCKS proxy implants, a PowerShell proxy script, reverse SSH tunnels, and **Level RMM** for persistence and lateral movement, with several binaries signed by the same certificate to appear legitimate. Rapid7 said one payload, `update6.exe`, attempted to exploit **`CVE-2022-26923`** to add a machine account for privilege escalation on vulnerable domain controllers, then moved to **Kerberoasting** by requesting Kerberos service tickets tied to service principal names and cracking them offline to recover service-account credentials. That technique can provide valid account access and support further privilege escalation, persistence, and lateral movement inside Windows domains. Rapid7 published indicators of compromise and urged defenders to use application allowlisting, block unapproved remote monitoring and management tools and related domains, train users to resist help-desk impersonation, and patch systems exposed to `CVE-2022-26923`.
Aug 15, 2026
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026