Back Securityaffairs.Co

UAT

Securityaffairs.Co •Pierluigi Paganini • February 26, 2026

UAT-10027 campaign is targeting U.S. education and healthcare sectors to deploy a new Dohdoor backdoor. Cisco Talos has identified a new threat cluster, tracked as UAT-10027, targeting U.S. education and healthcare organizations since at least December 2025 to deploy a previously unseen backdoor named Dohdoor. Initial access likely occurs through phishing, triggering a PowerShell script […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dohdoor Backdoor Attack Targets U.S. Education and Healthcare Sectors The UAT-10027 cyber campaign has been identified as targeting the U.S. education and healthcare sectors since at least December 2025. This campaign deploys a novel backdoor named Dohdoor, utilizing DNS-over-HTTPS for covert communications and employing advanced techniques such as DLL sideloading and process hollowing to evade detection. Initial access is likely gained through phishing attacks. 8 sources 41

Extracted Entities

UAT

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

Industries (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)