Dohdoor Malware Campaign Targeting U.S. Education and Healthcare Sectors

Summary

The Dohdoor malware campaign is a targeted intrusion operation actively compromising U.S. education and healthcare organizations. First observed on November 25, 2025, this sophisticated attack leverages phishing, DLL sideloading, and DNS-over-HTTPS (DoH) command-and-control (C2) communications to achieve stealthy, persistent access within high-value environments. Tracked under the cluster UAT-10027, the Dohdoor backdoor represents a previously undocumented threat that combines fileless execution techniques, process injection, and advanced defense evasion to evade endpoint detection and maintain long-term presence across compromised Windows systems.

The Dohdoor malware campaign reflects a capable threat actor deploying encrypted communications, in-memory payload delivery, and NTDLL unhooking to bypass security controls — posing a significant risk to U.S. education and healthcare sector networks.

Attack Details

Stage 1 — Initial Access via Phishing and PowerShell

The Dohdoor malware infection chain begins with a phishing or social engineering lure that prompts victims to execute a malicious PowerShell script. This script leverages legitimate Windows utilities such as curl.exe to retrieve additional components, ultimately delivering a malicious DLL disguised as a legitimate system file. The Dohdoor campaign’s reliance on trusted Windows binaries enables attackers to blend seamlessly into normal system activity, bypassing endpoint detection solutions.

Stage 2 — DLL Sideloading for Stealthy Execution

A core technique in the Dohdoor attack chain is DLL sideloading, where the malicious library is executed through trusted Windows binaries such as OpenWith.exe or wksprt.exe. By running within the context of legitimate processes, the Dohdoor malware evades endpoint defense solutions that rely on process-based detection. This approach is particularly effective against traditional antivirus and EDR solutions that trust signed Windows binaries.

Stage 3 — DNS-over-HTTPS (DoH) C2 Communications

A defining and technically sophisticated feature of the Dohdoor backdoor is its use of DNS-over-HTTPS (DoH) for command-and-control communications. By encrypting DNS traffic within HTTPS sessions over port 443 and routing through trusted cloud-hosted infrastructure, Dohdoor conceals its network activity within normal encrypted web traffic. The C2 infrastructure uses obfuscated, irregularly capitalized subdomains designed to mimic legitimate software update services (e.g., MswINsoFTUPDLoad[.]deSigN, deepInspectiOnSYSTEM[.]oNLiNE). C2 responses are decrypted using a custom position-dependent XOR-SUB routine with SIMD acceleration, enabling reflective, in-memory payload execution while minimizing disk artifacts.

Stage 4 — Post-Compromise Activity and Defense Evasion

Following initial compromise, the Dohdoor malware performs process hollowing and in-memory injection of secondary payloads, often deploying commercially available red team frameworks to support lateral movement, privilege escalation, and persistence. Advanced defense evasion techniques include NTDLL unhooking, API hashing for dynamic resolution, artifact clearing, and self-deletion. While limited technical overlaps with known state-aligned threat activity have been identified, attribution remains low confidence.

Recommendations

1. Strengthen Email & Script Controls

Implement advanced phishing protection and sandboxing to reduce malicious attachment delivery. Restrict and log PowerShell execution, including Script Block and Module Logging. Enforce application control policies to block unauthorized script and binary execution across all endpoints in education and healthcare environments.

2. Prevent DLL Sideloading Abuse

Audit and restrict execution of non-essential Windows binaries commonly abused for DLL sideloading (e.g., OpenWith.exe, wksprt.exe, mblctr.exe). Enforce code-integrity policies to allow only trusted, signed DLLs. Monitor for suspicious child processes spawned by legitimate system binaries as an indicator of Dohdoor malware activity.

3. Monitor and Restrict DNS-over-HTTPS (DoH)

Limit DoH usage to approved resolvers and block unauthorized encrypted DNS traffic. Monitor outbound HTTPS for anomalous DoH patterns and suspicious domain naming conventions (e.g., irregular capitalization patterns). Leverage TLS metadata and behavioral analytics to detect covert Dohdoor C2 activity.

4. Enhance Endpoint Behavioral Detection

Enable logging and detection for process injection, process hollowing, and reflective in-memory loading. Monitor for syscall unhooking and API hashing behaviors consistent with Dohdoor’s defense evasion techniques. Align detections with relevant MITRE ATT&CK techniques (T1574.002, T1055.001) for proactive threat hunting.

5. Strengthen Post-Compromise Resilience

Enforce least-privilege access and implement network segmentation to reduce blast radius from a Dohdoor intrusion. Monitor privileged account usage and credential abuse indicators. Maintain updated incident-response playbooks and ensure centralized log retention for rapid detection and containment.

Indicators of Compromise (IoCs)

SHA256 Hashes

• 54e18978c6405f56cd59ba55a62291436639f21cf325ae509f0599b15e8f7f53
• 0bb130b1fafb17705d31fe5dd25e7b2d62176578609d75cc57911ef5582ef17a
• 54545fa3a2d8da6746021812ebaa9d26f33bba4f63c6f7f35caa6fa4ee8c0e6a
• 8e97c677aec905152f8a92fed50bb84ef2e8985d5c29330c5a05a4a2afcbd4a5
• 800faaf15d5f42f2ab2c1d2b6b65c8a9e4def6dc10f6ce4e269dcf23f4e8dae2
• b1bd8f7d4488977cca03954a57f5c8ad7bfd4609bcc3bae92326830fcbd3232c
• 2ce3e75997f89b98dd280d164a5f21f7565f4de26eed61243badde04b480700e

Malicious URLs

• hxxp[://]gITkzxd[.]pNUIScKMhWAgZvdyJRlBEFT[.]SoFtwaRE/X111111
• hxxp[://]GppiwoGwNdiakkDU[.]pnuiSckMHwaGzvDYjRLbeFt[.]SoFTWARe/111111?sub=s
• hxxp[://]lBaNDUgZCFG[.]deepInspectiOnSYSTEM[.]oNLiNE/X111111
• hxxp[://]CJiTDrpwnnA[.]MswINsoFTUPDLoad[.]deSigN/x111111
• hxxp[://]LsyPdQGXrEDfPx[.]MSwInSofTUpDloAd[.]dESign/111111?sub=s
• hxxp[://]sDXsIol[.]PNUIsckmHwAgzVdYJRlbeFT[.]SoftWarE/X111111
• hxxp[://]ezQrvkFgEJWCTDNc[.]pNuiSCKMhwAgZvdyjrlBEFT[.]softwarE/111111?sub=d
• hxxp[://]lLalWpIJnjskClwY[.]PnUiscKMhWaGzVdyJRlBEfT[.]SofTWaRe/111111?sub=s

Malicious Host Names

• CJiTDrpwnnA[.]MswINsoFTUPDLoad[.]deSigN
• LBaNDUgZCFG[.]deepInspectiOnSYSTEM[.]oNLiNE
• LsyPdQGXrEDfPx[.]MSwInSofTUpDloAd[.]dESign
• YHDJTyLNsMWVuU[.]DEEPinSPeCTioNsyStEM[.]OnLiNe
• SDXsIol[.]PNUIsckmHwAgzVdYJRlbeFT[.]SoftWarE
• EzQrvkFgEJWCTDNc[.]pNuiSCKMhwAgZvdyjrlBEFT[.]softwarE
• txjIQslrRIg[.]MSwINSOFTUPDLoaD[.]DesiGN
• QHtcKZBXtKdVyr[.]mSWinSoFTUpdLOAD[.]DeSIgn
• GITkzxd[.]pNUIScKMhWAgZvdyJRlBEFT[.]SoFtwaRE
• GppiwoGwNdiakkDU[.]pnuiSckMHwaGzvDYjRLbeFt[.]SoFTWARe

MITRE ATT&CK TTPs

References

• https://blog.talosintelligence.com/new-dohdoor-malware-campaign/
• https://github.com/Cisco-Talos/IOCs/blob/main/2026/02/new-dohdoor-malware-campaign.txt