Dohdoor

Cisco Talos Exposes ‘Dohdoor’ Backdoor Using DNS-over-HTTPS in U.S. Education and Healthcare Attacks

Talos says the implant hides its command traffic behind Cloudflare to evade DNS-based detection.