New Dohdoor malware campaign targets education and health care

Cisco Talos identified a new malware campaign dubbed UAT-10027 targeting education and healthcare sectors in South Korea using DNS-over-HTTPS (DoH) to evade detection. The malware, named Dohdoor, employs process hollowing, custom XOR-SUB decryption with position-dependent techniques, and NTDLL unhooking to bypass EDR monitoring. Talos observed similarities between Dohdoor's tactics and those of North Korean APT Lazarus but noted deviations in targeting sectors. ClamAV signatures and SNORT rules are provided for detection and mitigation.

Read the full article at Cisco Talos

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.