How We Tracked The Dohdoor Backdoor’s Encrypted C2 Channel Using DNS-over-HTTPS Behavioral Analysis

UAT-5027 is a threat actor observed actively since at least December 2025. Their primary tool, Dohdoor, is a multi-stage backdoor distinguished by its use of DNS-over-HTTPS for C2 communication. The campaign targets organizations across multiple verticals and geographies, with the infection chain specifically designed to survive traditional security tooling.

The infection chain operates as follows:

• Initial access is achieved via phishing or drive-by compromise, delivering a dropper payload.
• DLL sideloading via legitimate signed binaries (Defense Evasion) stages the primary backdoor component.
• PowerShell and batch scripts execute encoded payloads, with obfuscation to evade static analysis.
• The backdoor establishes C2 by issuing HTTPS requests to known DoH resolvers (Google, Cloudflare, Quad9), encoding commands within DNS query strings.
• Process injection techniques (including process hollowing) enable persistence within legitimate host processes.

DNS-over-HTTPS is a privacy feature that encrypts DNS queries inside HTTPS traffic. Browsers like Chrome, Firefox, and Edge use it to prevent DNS eavesdropping. Dohdoor weaponizes this same mechanism: instead of a browser querying dns.google for a website, a script or injected process queries the same endpoint to retrieve encoded C2 instructions.

From a network perspective, this traffic is indistinguishable from normal browser DoH requests. Both generate port-443 HTTPS connections to dns.google or cloudflare-dns.com. The critical distinction is the initiating process: browsers are expected to make these calls; PowerShell.exe, cmd.exe, wscript.exe, or unknown executables are not.

Our hunt was conducted across (DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents) and Microsoft Sentinel over a 30-day window. Rather than hunting for static IOCs, we applied a behavioral approach: identify HTTPS connections to DoH endpoints that originate from non-browser processes, then layer on beaconing analysis and environmental rarity scoring.

The full KQL query is provided below. It combines four detection signals:

• Protocol indicator: HTTPS port-443 traffic to known DoH resolvers or URLs containing /dns-query or encoded query strings.
• Process exclusion: all major browser processes are filtered out, isolating anomalous initiators.
• Beaconing analysis: average connection intervals between 10–300 seconds flag automated, periodic callback behavior.
• Risk scoring: Living-off-the-Land Binaries (LOLBins) such as PowerShell and cmd receive elevated risk weight.

• Restrict DoH at the enterprise level using Group Policy or Intune MDM to prevent endpoints from bypassing DNS security controls.
• Deploy DNS Firewall / RPZ policies to block DoH endpoints for non-browser traffic at the network layer.
• Enable Microsoft Defender for Endpoint’s Network Protection to block suspicious outbound connections from LOLBins.

• Immediately isolate the affected endpoint using Microsoft Defender for Endpoint’s device isolation capability.
• Collect a forensic snapshot: process tree, network connections, loaded DLLs, and recent file creation events.
• Hunt laterally: query for the same initiating process across all devices in the estate using DeviceNetworkEvents.
• Revoke and rotate any credentials or tokens that may have been accessible on the compromised host.
• Submit identified file hashes and C2 IPs to Microsoft Defender Threat Intelligence for IOC enrichment.
• Patch and harden: validate no unsigned DLLs are present in paths abused by sideloading techniques.

The abuse of encrypted infrastructure for C2 is not new, but the weaponization of DoH marks a qualitative shift. Threat actors are no longer merely hiding in encrypted traffic — they are hiding inside the same services and ports used by legitimate enterprise applications. This eliminates the reliability of domain-based or port-based detection for this threat class.

DNS-over-HTTPS C2 is designed specifically to defeat the security controls most enterprises rely on. The business risks are not theoretical:

• Data exfiltration: Encoded DNS queries can carry stolen data out of the organization through port 443, bypassing DLP controls that do not inspect process context.
• Persistent access: The beaconing pattern maintains a long-lived, low-noise C2 channel that can persist for months without triggering threshold-based alerts.
• Regulatory exposure: For organizations subject to GDPR, NCA CSF, or sector-specific frameworks, an undetected compromise constitutes a notifiable breach with material financial and reputational consequences.
• Operational disruption: Once initial access is confirmed, actors can pivot to ransomware deployment or destructive activity, leveraging the same trusted binaries used for C2.

WIZARD cyber Threat Hunting team operates proactively across all managed environments, hunting for emerging threat patterns before they surface as confirmed incidents. Our response to the Dohdoor campaign is a direct example of this model in action:

• 24/7 Threat Monitoring via Microsoft Sentinel: Continuous ingestion and correlation of endpoint, identity, and network telemetry, with custom detection rules tuned to your environment.
• Managed Detection & Response (MDR) via Microsoft Defender XDR: Automated containment integrated with human analyst triage, reducing mean time to respond across all endpoints.
• Proactive Threat Hunting: Hypothesis-driven hunts like this one, aligned to emerging threat intelligence, executed across your full estate before attacker objectives are achieved.
• Incident Response & Containment Support: Rapid response capability including device isolation, forensic triage, and guided remediation when a confirmed compromise is identified.
• KQL Detection Engineering: Custom detection content developed from real-world hunts, continuously improved and deployed to your Sentinel and Defender XDR environment.