UAT-10027

UAT-10027 is a threat activity cluster tracked by Cisco Talos that has conducted an ongoing campaign since at least December 2025 targeting U.S. education and healthcare organizations. Talos reported the actor’s objective was to deliver a previously undisclosed backdoor/loader named Dohdoor. The intrusion chain was assessed as likely beginning with social-engineering phishing, followed by PowerShell and batch-script stages that downloaded a malicious DLL and executed it via DLL sideloading using legitimate Windows executables such as Fondue.exe, mblctr.exe, and ScreenClippingHost.exe. Talos also reported misuse of living-off-the-land binaries, anti-forensic cleanup including deletion of RunMRU history, clipboard clearing, and self-deletion of the batch script. Dohdoor uses DNS-over-HTTPS to Cloudflare DNS to resolve command-and-control infrastructure and then communicates over HTTPS through Cloudflare-backed infrastructure to blend with legitimate traffic. Reported subdomains included strings such as "MswInSofTUpDloAd" and "DEEPinSPeCTioNsyStEM," and Talos noted irregular capitalization and TLDs such as .online, .design, and .software. Dohdoor dynamically resolves APIs via hash-based lookups, downloads encrypted payloads, decrypts them with a custom XOR-SUB routine, and executes them in memory via process hollowing into legitimate Windows binaries including OpenWith.exe, wksprt.exe, ImagingDevices.exe, and wab.exe. Talos also reported EDR-evasion behavior involving unhooking or patching syscall stubs in ntdll.dll. Talos found OSINT suggesting a likely follow-on Cobalt Strike Beacon payload, but stated they did not recover a definitive downloaded payload. Cisco Talos assessed with low confidence that UAT-10027 may be North Korea-nexus based on tradecraft overlaps with Lazarus Group tooling, including similarities between Dohdoor and Lazarloader such as the XOR-SUB decryption routine and NTDLL unhooking techniques. Talos also noted that the campaign’s victimology differs from Lazarus’ more typical cryptocurrency and defense targeting. Attribution remains unconfirmed. No aliases or sub-groups beyond the tracking name UAT-10027 were directly identified in the provided content.