Fake Security Tool Spreads LucidRook in Taiwan Cyberattacks

Cisco Talos reports a targeted, espionage-focused campaign (UAT-10362) using spear-phishing and fake security tools to deploy a modular malware suite — notably LucidRook (Lua/Rust-based stager), LucidPawn (dropper), and LucidKnight (reconnaissance) — against Taiwanese NGOs and academic-related targets; the actors employ living-off-the-land techniques, DLL sideloading, encrypted staged payloads delivered via FTP, geo/language checks to avoid analysis, and tailored decoys to maintain stealth and persistence.