1. How the Attack Gets In and Runs
The exact entry point is still being investigated, but the available evidence strongly points to a phishing-based social engineering campaign as the main delivery method.
Multi-Stage Loader Architecture
The infection plays out in a structured, step-by-step execution chain:
Stage 1 – PowerShell Bootstrapper: The attack starts with a malicious PowerShell script that connects to a remote staging server to pull down a second-stage payload.
Stage 2 – Batch Script Retrieval: A Windows batch script is downloaded and run. Its job is to set up and deploy the main malware component.
Stage 3 – Malicious DLL Deployment: The batch script then fetches a Dynamic Link Library (DLL) disguised as a legitimate system file, often using convincing names like propsys.dll or batmeter.dll.
Stage 4 – DLL Side-Loading Abuse: The attackers take advantage of legitimate, signed Windows binaries — such as Fondue.exe, mblctr.exe, and ScreenClippingHost.exe — to load the malicious DLL. By placing the fake library in the same folder as the trusted executable, the Windows loader picks up the attacker’s DLL first, effectively running the malicious payload under the cover of a trusted process.
This side-loading technique is reliable and helps evade defenses by hiding behind trusted binaries.
2. Dohdoor: What the Backdoor Does
The custom backdoor, called Dohdoor, sets up persistence on the infected system and acts as a launchpad for further post-exploitation activity.
Command-and-Control via DNS-over-HTTPS
Dohdoor’s most notable feature is its use of DoH for C2 traffic.
Infrastructure Obfuscation: C2 endpoints are hidden behind Cloudflare’s infrastructure, making outbound traffic look like normal HTTPS traffic going to widely trusted IP ranges.
Encrypted DNS Tunneling: By wrapping DNS queries inside HTTPS (TCP port 443), the malware gets around conventional DNS monitoring. This approach prevents DNS sinkholes from intercepting traffic, hides suspicious domain lookups, and makes the network traffic look like routine encrypted web browsing. The end result is that network-level detection becomes much harder.
Endpoint Defense Evasion
Dohdoor also takes active steps to disable Endpoint Detection and Response (EDR) monitoring.
User-Mode Hook Detection and Removal: The malware scans NTDLL.dll for user-mode hooks that EDR tools commonly place there. When it finds them, it performs syscall unhooking a.k.a. restoring the original in-memory code to which lets it make direct system calls and bypass user-mode monitoring entirely.
Reflective DLL Injection: Dohdoor can load additional payloads directly into memory without ever writing them to disk. This fileless execution approach drastically reduces forensic evidence and limits the chances of signature-based detection.
3. Post-Exploitation: Cobalt Strike Deployment
Once a foothold is established, the operators deploy a Cobalt Strike Beacon as their main post-exploitation framework. The Beacon gives them a broad offensive toolkit, including lateral movement across internal networks, privilege escalation, remote command execution, credential harvesting, and network reconnaissance. This shift from initial access to a full-featured intrusion toolkit points to a well-structured attack lifecycle typical of professional threat actors.
| Attribute | Detail |
|---|---|
| Primary Targets | U.S. Education & Healthcare (including elderly care facilities) |
| Initial Backdoor | Dohdoor |
| Post-Exploitation Framework | Cobalt Strike Beacon |
| C2 Channel | DNS-over-HTTPS (DoH) |
| Persistence Mechanism | DLL Side-Loading |
4. Attribution and Strategic Context
No formal attribution has been confirmed. However, Cisco Talos has spotted tactical similarities between this campaign and LazarLoader, a malware family historically linked to the North Korean Lazarus Group.
Similarities include overlapping loader design and execution methods, the use of multi-stage infection chains, and similarly sophisticated evasion techniques.
Differences include target selection — Lazarus operations have traditionally focused on cryptocurrency platforms and defense-related organizations, while UAT-10027 has gone after healthcare and educational institutions — and the overall sectoral focus diverges from Lazarus’s typical financial targeting patterns.
That said, other North Korean-linked actors like Kimsuky and the operators behind Maui ransomware have previously hit healthcare and public sector targets, leaving open the possibility that UAT-10027 is either a sub-cluster of a known group or represents a deliberate strategic shift.
While confirmed data exfiltration hasn’t been publicly documented, the focus on high-impact, revenue-dependent sectors suggests a financially motivated objective. The attack’s trajectory is consistent with potential ransomware deployment, extortion, or selling off compromised access to other threat actors.