{"id":553,"date":"2026-04-09T17:17:57","date_gmt":"2026-04-09T17:17:57","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=553"},"modified":"2026-04-09T17:17:57","modified_gmt":"2026-04-09T17:17:57","slug":"uat-10362-targets-taiwanese-ngos-with-lucidrook-malware-in-spear-phishing-campaigns","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=553","title":{"rendered":"UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 09, 2026<\/span><\/span>Malware \/ Windows Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A previously undocumented threat cluster\u00a0dubbed UAT-10362<\/strong> has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook.<\/p>\n

\u00abLucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and execute staged Lua bytecode payloads,\u00bb Cisco Talos researcher Ashley\u00a0Shen said<\/a>.<\/p>\n

The cybersecurity company said it discovered the activity in October 2025, with the attack using RAR or 7-Zip archives lures to deliver a dropper called LucidPawn, which then opens a decoy file and launches LucidRook. A\u00a0notable characteristic of the intrusion set is the use of DLL side-loading to execute both LucidPawn and LucidRook.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

There are two distinct infection chains that\u00a0lead to LucidRook, one using a Windows Shortcut (LNK) file with a PDF icon and another involving an executable that masquerades as an antivirus program from Trend Micro. The\u00a0entire sequence is listed below\u00a0–<\/p>\n