Loading story…
Trend Micro reported that the China-aligned threat group Earth Lusca targeted organizations in Taiwan with politically themed social-engineering lures tied to cross-strait tensions and the island’s election period. The campaign used documents and decoy content crafted to appear relevant to current geopolitical developments, aiming to entice victims into opening malicious files and initiating compromise.
The activity was attributed to a broader cyber-espionage effort focused on Taiwan, with the attackers seeking access to targeted environments for intelligence collection. Trend Micro said the operation reflected Earth Lusca’s established pattern of using timely regional issues to improve phishing success and maintain persistent access against government and other organizations of strategic interest.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing an Earth Lusca campaign that used geopolitical lures to target Taiwan ahead of its elections. The report indicates the activity was active before the election period, but the reference provides no specific earlier event dates.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro researchers reported that the Chinese-speaking threat actor **Earth Lusca** used a previously undocumented Golang backdoor called **KTLVdoor** in a broad intrusion campaign targeting both **Windows** and **Linux** systems. The malware was designed for stealth, often disguising itself as legitimate system utilities while giving operators extensive remote access, including command execution, file management, proxying, and port scanning. Investigators identified at least one victim, a trading company in China. KTLVdoor uses a custom TLV-like configuration format with encrypted values and protects command-and-control traffic with **GZIP** and **AES-GCM**, complicating analysis and detection. Researchers tied the activity to more than **50** command-and-control servers hosted on Alibaba infrastructure in China, but said attribution across the full server set remains uncertain because some tooling or infrastructure may be shared with other Chinese-speaking threat actors.
Aug 14, 2026
China-linked threat actor **Earth Lusca** expanded its operations globally while continuing to concentrate on Southeast Asia, Central Asia, and the Balkans, according to Trend Micro. Researchers recovered and decrypted a previously unseen Linux backdoor dubbed **SprySOCKS** from the group’s delivery infrastructure, linking it to campaigns targeting government departments involved in foreign affairs as well as organizations in the technology and telecommunications sectors. Trend Micro said SprySOCKS appears to be a Linux adaptation of the open-source Windows backdoor **Trochilus**, with an interactive shell resembling **Linux Derusbi** and a command-and-control protocol similar to **RedLeaves RAT**. The malware uses a two-part architecture consisting of a loader and an encrypted main payload, and multiple version markers indicate it remains under active development. Investigators also observed Earth Lusca using **Cobalt Strike** for lateral movement and aggressively exploiting public-facing servers through server-side **N-day vulnerabilities** to gain access.
Jun 29, 2026
Cisco Talos reported that a threat cluster tracked as **UAT-10362** conducted targeted spear-phishing attacks against organizations in Taiwan, particularly NGOs and suspected universities, to deliver a newly identified malware family called **LucidRook**. The campaign used Traditional Chinese lures, shortened URLs, password-protected archives, malicious `LNK` files, and decoy documents including a purported Taiwanese government letter. In one infection chain, attackers used a forged .NET executable disguised as security software, including a fake Trend Micro-themed lure, alongside DLL search-order hijacking with a legitimate DISM-related executable to load the LucidRook stager. LucidRook is a Windows DLL stager that embeds a **Lua 5.4.8** interpreter and Rust-compiled components, performs host reconnaissance, encrypts collected data, exfiltrates information over FTP, and retrieves additional encrypted Lua bytecode for execution. Talos also identified related tools including **LucidPawn/LucidPan**, a dropper that enforced geo-targeting checks for Traditional Chinese environments associated with Taiwan, and **LucidKnight/LucidNight**, a reconnaissance utility that gathered system data and exfiltrated it through Gmail. The attackers also abused compromised or exposed FTP infrastructure at Taiwanese printing companies and used a public OAST service to confirm execution, leading Talos to assess with medium confidence that the activity was part of a focused intrusion operation rather than broad opportunistic malware distribution.
Jun 29, 2026