Threat Intelligence / Actor / UAT-10027

UAT-10027

As of 2026-07-28, UAT-10027 is a North Korea-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware.

Nation: North Korea · 1 tracked threat(s) · Categories: MALWARE

Tracked threats

Dohdoor Backdoor — UAT-10027 DNS-over-HTTPS C2 Campaign Targeting US Education & Healthcare via Cloudflare Tunnel, DLL Sideloading, Cobalt Strike — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence