SecuriTricks - dns over https

New Dohdoor malware campaign targets education and health care

A malicious campaign by threat actor UAT-10027 has been targeting education and healthcare sectors in the United States since December 2025. The campaign utilizes a new backdoor called Dohdoor, which employs DNS-over-HTTPS for stealthy command-and-control communications and can download and execute…

backdoor

healthcare

Published: February 27, 2026

Downloadable IOCs: 10

Henry IV, Hotspur, Hal, and hallucinations

This article draws parallels between Shakespeare's Henry IV and modern cybersecurity challenges, particularly focusing on the adoption of AI. It emphasizes the importance of taking calculated risks, learning from failures, and surrounding oneself with knowledgeable peers. The piece also highlights …

Published: February 27, 2026

Linked vulnerabilities : CVE-2026-20127 (CVSS 10.0)

Downloadable IOCs: 5

SHOE RACK: A post-exploitation tool for remote shell access & TCP tunnelling through a victim device

SHOE RACK is a sophisticated malware developed in Go 1.18, designed for post-exploitation activities. It connects to a custom SSH server at a hardcoded C2 URL, enabling remote interaction with the victim device. The malware utilizes DNS-over-HTTPS to locate its C2 server's IP address and has been o…

Published: June 26, 2025

Downloadable IOCs: 3

Updated Shadowpad Malware Leads to Ransomware Deployment

A recent investigation revealed Shadowpad malware being used to deploy a new ransomware family in Europe. The threat actor targeted 21 companies across 15 countries, primarily in the manufacturing sector. Access was gained through remote network attacks, exploiting weak passwords and bypassing mult…

multi-factor authentication bypass

remote network attacks

intellectual property theft

cqhashdumpv2

Published: February 20, 2025

Downloadable IOCs: 0

Tag: dns over https

Attack reports

New Dohdoor malware campaign targets education and health care

Henry IV, Hotspur, Hal, and hallucinations

SHOE RACK: A post-exploitation tool for remote shell access & TCP tunnelling through a victim device

Updated Shadowpad Malware Leads to Ransomware Deployment