LucidRook: Sophisticated Spear-Phishing Campaign Targets Taiwan with Custom Malware Stack

Cisco Talos uncovered a sophisticated, targeted campaign (UAT-10362) against Taiwanese NGOs and universities using a multi-component malware suite: LucidRook (Lua-interpreter stager with Rust libraries), LucidKnight (recon/exfiltration via Gmail), and LucidPawn (Traditional Chinese environment-locked dropper). Attackers employ malicious LNK/EXE lures disguised as antivirus, abuse public infrastructure and compromised FTP servers for C2, and implement layered anti-analysis and region-specific checks to maintain stealth and persistence.