Loading story…
Cisco Talos reported that a threat cluster tracked as UAT-10362 conducted targeted spear-phishing attacks against organizations in Taiwan, particularly NGOs and suspected universities, to deliver a newly identified malware family called LucidRook. The campaign used Traditional Chinese lures, shortened URLs, password-protected archives, malicious LNK files, and decoy documents including a purported Taiwanese government letter. In one infection chain, attackers used a forged .NET executable disguised as security software, including a fake Trend Micro-themed lure, alongside DLL search-order hijacking with a legitimate DISM-related executable to load the LucidRook stager.
LucidRook is a Windows DLL stager that embeds a Lua 5.4.8 interpreter and Rust-compiled components, performs host reconnaissance, encrypts collected data, exfiltrates information over FTP, and retrieves additional encrypted Lua bytecode for execution. Talos also identified related tools including LucidPawn/LucidPan, a dropper that enforced geo-targeting checks for Traditional Chinese environments associated with Taiwan, and LucidKnight/LucidNight, a reconnaissance utility that gathered system data and exfiltrated it through Gmail. The attackers also abused compromised or exposed FTP infrastructure at Taiwanese printing companies and used a public OAST service to confirm execution, leading Talos to assess with medium confidence that the activity was part of a focused intrusion operation rather than broad opportunistic malware distribution.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The attackers were observed leveraging compromised or publicly exposed FTP infrastructure at Taiwanese printing companies and using a public OAST service to confirm code execution. These operational details provided additional insight into the campaign's supporting infrastructure.
Cisco Talos also identified a related reconnaissance utility, referred to as LucidKnight/LucidNight, that collects system information and exfiltrates it via Gmail. The finding suggested UAT-10362 maintains a modular, tiered toolkit for profiling targets and enabling follow-on compromise.
Cisco Talos discovered LucidRook, a DLL stager that embeds a Lua 5.4.8 interpreter and Rust-compiled components, performs host reconnaissance, exfiltrates encrypted data over FTP, and retrieves additional Lua bytecode payloads for execution. Talos assessed with medium confidence that the activity reflects targeted intrusion operations rather than broad opportunistic malware distribution.
The campaign used two delivery chains: malicious LNK files and a forged .NET executable disguised as antivirus software. In the fake security software chain, a dropper identified as LucidPawn/LucidPan performed geo-targeting checks for Taiwanese environments and abused DLL search order hijacking to load the LucidRook stager.
A threat cluster tracked as UAT-10362 conducted targeted spear-phishing campaigns against organizations in Taiwan, particularly NGOs and suspected universities. The lures used Traditional Chinese content, shortened URLs, password-protected archives, and decoy documents to appear credible.
Cisco Talos discovered the UAT-10362 spear-phishing activity in October 2025, observing campaigns aimed at Taiwanese NGOs and suspected universities. This establishes the campaign was active months before Talos publicly reported the malware and tradecraft in April 2026.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Cisco Talos reported that Chinese-speaking threat actor **UAT-10147** targeted vulnerable internet-facing **Windows IIS** and **Linux** servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to **SEO fraud** and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly **170,000 URLs**. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, **EfsPotato**, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access. A central payload in the campaign was **SPECTRE**, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a **BYOVD** technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called **Specter**, disguised as `acpi_pad.ko` and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed **Noodle RAT**, **QuasarRAT**, **Gh0stCringe**, **Meterpreter**, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to `/tmp/CCCCCCCC`, decrypt configuration with RC4 using the hardcoded key `r0st@#$`, and connect to attacker-controlled C2 servers.
Aug 28, 2026
Palo Alto Networks Unit 42 reported that the Chinese-speaking intrusion cluster **CL-STA-1062**, assessed with high confidence to overlap with Cisco Talos' **UAT-7237**, conducted sustained operations across East and Southeast Asia from at least 2022 through 2025. In 2025, the group targeted Southeast Asian government entities and state-owned critical energy infrastructure, using web application exploitation, **ASPX web shells**, reconnaissance, lateral movement, and data exfiltration to maintain access and steal information. Investigators said the actors combined open-source tooling including **SoftEther VPN**, **VNT**, **yuze**, **Mimikatz**, and **JuicyPotato** with a newly documented custom .NET backdoor, **TinyRCT**. The malware supports command execution, file listing and exfiltration, screenshot capture, encrypted HTTP-based command-and-control, and a self-destruct feature intended to erase forensic evidence. Unit 42 also reconstructed an infection chain in which a malicious `chrome_setup.zip` archive used **AppDomainManager Injection** to load a malicious DLL, download `PerfWatson2.exe` from attacker infrastructure, and establish persistence through a scheduled task.
Aug 11, 2026