Loading story…
Cisco Talos reported that a threat cluster tracked as UAT-10362 conducted targeted spear-phishing attacks against organizations in Taiwan, particularly NGOs and suspected universities, to deliver a newly identified malware family called LucidRook. The campaign used Traditional Chinese lures, shortened URLs, password-protected archives, malicious LNK files, and decoy documents including a purported Taiwanese government letter. In one infection chain, attackers used a forged .NET executable disguised as security software, including a fake Trend Micro-themed lure, alongside DLL search-order hijacking with a legitimate DISM-related executable to load the LucidRook stager.
LucidRook is a Windows DLL stager that embeds a Lua 5.4.8 interpreter and Rust-compiled components, performs host reconnaissance, encrypts collected data, exfiltrates information over FTP, and retrieves additional encrypted Lua bytecode for execution. Talos also identified related tools including LucidPawn/LucidPan, a dropper that enforced geo-targeting checks for Traditional Chinese environments associated with Taiwan, and LucidKnight/LucidNight, a reconnaissance utility that gathered system data and exfiltrated it through Gmail. The attackers also abused compromised or exposed FTP infrastructure at Taiwanese printing companies and used a public OAST service to confirm execution, leading Talos to assess with medium confidence that the activity was part of a focused intrusion operation rather than broad opportunistic malware distribution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The attackers were observed leveraging compromised or publicly exposed FTP infrastructure at Taiwanese printing companies and using a public OAST service to confirm code execution. These operational details provided additional insight into the campaign's supporting infrastructure.
Cisco Talos also identified a related reconnaissance utility, referred to as LucidKnight/LucidNight, that collects system information and exfiltrates it via Gmail. The finding suggested UAT-10362 maintains a modular, tiered toolkit for profiling targets and enabling follow-on compromise.
Cisco Talos discovered LucidRook, a DLL stager that embeds a Lua 5.4.8 interpreter and Rust-compiled components, performs host reconnaissance, exfiltrates encrypted data over FTP, and retrieves additional Lua bytecode payloads for execution. Talos assessed with medium confidence that the activity reflects targeted intrusion operations rather than broad opportunistic malware distribution.
The campaign used two delivery chains: malicious LNK files and a forged .NET executable disguised as antivirus software. In the fake security software chain, a dropper identified as LucidPawn/LucidPan performed geo-targeting checks for Taiwanese environments and abused DLL search order hijacking to load the LucidRook stager.
A threat cluster tracked as UAT-10362 conducted targeted spear-phishing campaigns against organizations in Taiwan, particularly NGOs and suspected universities. The lures used Traditional Chinese content, shortened URLs, password-protected archives, and decoy documents to appear credible.
Cisco Talos discovered the UAT-10362 spear-phishing activity in October 2025, observing campaigns aimed at Taiwanese NGOs and suspected universities. This establishes the campaign was active months before Talos publicly reported the malware and tradecraft in April 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that the Chinese-speaking intrusion cluster **CL-STA-1062**, assessed with high confidence to overlap with Cisco Talos' **UAT-7237**, conducted sustained operations across East and Southeast Asia from at least 2022 through 2025. In 2025, the group targeted Southeast Asian government entities and state-owned critical energy infrastructure, using web application exploitation, **ASPX web shells**, reconnaissance, lateral movement, and data exfiltration to maintain access and steal information. Investigators said the actors combined open-source tooling including **SoftEther VPN**, **VNT**, **yuze**, **Mimikatz**, and **JuicyPotato** with a newly documented custom .NET backdoor, **TinyRCT**. The malware supports command execution, file listing and exfiltration, screenshot capture, encrypted HTTP-based command-and-control, and a self-destruct feature intended to erase forensic evidence. Unit 42 also reconstructed an infection chain in which a malicious `chrome_setup.zip` archive used **AppDomainManager Injection** to load a malicious DLL, download `PerfWatson2.exe` from attacker infrastructure, and establish persistence through a scheduled task.
Aug 11, 2026
Researchers uncovered multiple malware operations using scalable builder and crypting infrastructure to deliver remote-access trojans and evade detection. Breakglass Intelligence found two unauthenticated **GoLoader** builder panels that had produced **468,349** polymorphic samples across 71 active tasks, while leaking Alibaba Cloud OSS credentials tied to a public bucket containing LNK droppers, polymorphic VBS scripts, steganographic PNG carriers, .NET loaders, and RAT payloads. The reconstructed infection chain ended with **njRAT**, and reversing its custom AES-256-ECB configuration revealed the C2 `laohe1[.]myvnc[.]com:5000`, overlapping with infrastructure previously associated with **XWorm**. The campaign was assessed with moderate confidence as operated by a Chinese-speaking actor using Simplified Chinese cryptocurrency lures. A separate Breakglass report linked **ValleyRAT** samples targeting Chinese-speaking users to a campaign that blended long-lived Hong Kong infrastructure with a likely compromised UK academic relay. One sample connected to `103.215.77[.]17:4488`, a Hong Kong-hosted server linked to dozens of related malware submissions, while another Rust loader masquerading as **Microsoft OneDrive Sync Engine** decrypted and loaded a ValleyRAT core DLL after sandbox checks; its stage-two C2 used a `govroam.cf.ac[.]uk` hostname resolving into Cardiff University space, suggesting temporary relay use through a compromised GovRoam-connected endpoint. In parallel, researchers analyzing the **FUD Crypt** malware-as-a-service platform found it packaged Windows malware with persistence, C2, and evasion features, tracked **200** registered users and **334** confirmed builds, and documented abuse of Microsoft **Azure Trusted Signing** to produce Microsoft-rooted Authenticode signatures for malicious binaries.
Jun 29, 2026