Cisco TalosPublished
New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
By Ashley Shen
Excerpt
Wednesday, April 8, 2026 06:00
Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.”
LucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and execute staged Lua bytecode payloads. The dropper “LucidPawn” uses region-specific anti-analysis checks and executes only in Traditional Chinese language environments associated with Taiwan.
Talos…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Cisco Talos on blog.talosintelligence.com.
Mentioned in the excerpt
More from Cisco Talos7
- The Closed Quorum: Inside the first reported autonomous AI C2 implantCisco Talos · Published 22 Sep
- UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignCisco Talos · Published 16 Jul
- UAT-7810 continues building ORB networks using new malwareCisco Talos · Published 7 Jul
- New Dohdoor malware campaign targets education and health careCisco Talos · Published 26 Feb
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
