UAT-10362 linked to LucidRook attacks targeting Taiwan-based institutions

**Executive summary:** The report describes LucidRook, a modular Lua-based Windows DLL stager delivered via targeted spear-phishing (password-protected archives and shortened URLs) against Taiwanese NGOs and universities and linked to the UAT-10362 actor. Researchers observed two infection chains (shortcut/LOLBAS-based and .NET EXE dropper), DISM DLL sideloading, persistence via Startup LNKs, FTP-based C2 that retrieves encrypted Lua bytecode, and companion tooling (LucidPawn, LucidKnight) used for reconnaissance and exfiltration; the activity is assessed as a targeted, technically sophisticated intrusion.