Cisco Talos Links LucidRook to Phishing Attacks on Taiwanese NGOs and Universities
Summary
Cisco Talos says UAT-10362 used LucidRook in October 2025 phishing campaigns against Taiwanese NGOs and universities. The Lua-based backdoor supports bytecode payloads; Talos could not recover a decryptable payload, so post-infection actions remain unknown.
Key points
- Cisco Talos attributed October 2025 spear-phishing campaigns targeting NGOs and universities in Taiwan to UAT-10362.
- The campaigns used password-protected archives and two infection chains: an LNK-based chain and an EXE chain using a fake Trend Micro executable.
- The LNK chain used LucidPawn to sideload LucidRook alongside a legitimate executable renamed to resemble Microsoft Edge.
- LucidRook embeds a Lua execution environment to run second-stage bytecode payloads, which operators can update separately from the core malware.
- The backdoor collects system information, encrypts it with RSA, archives it, and exfiltrates it via FTP; a related tool, LucidKnight, reportedly uses Gmail GMTP.
- Talos said it could not recover decryptable Lua bytecode, so the specific actions after infection are unknown.
Article Details
- Attack Vectors
- October 2025 spear-phishing emails delivered password-protected archives to NGOs and universities in Taiwan.
- One infection chain used an LNK shortcut and the LucidPawn dropper; another used a fake antivirus executable impersonating Trend Micro Worry-Free Business Security Services.
- LucidPawn deployed a legitimate executable renamed to mimic Microsoft Edge alongside a malicious DLL, DismCore.dll, to sideload LucidRook.
- LucidRook retrieved and executed second-stage payloads as Lua bytecode.
- LucidRook collected system information, encrypted it with RSA, placed it in password-protected archives, and exfiltrated it via FTP. A related tool, LucidKnight, reportedly used Gmail GMTP for exfiltration.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article reports extensive obfuscation of LucidRook's strings, file extensions, internal identifiers, and C2 addresses.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe article reports exfiltration of collected data via FTP.T1057 · Process DiscoveryLucidRook collects information about running processes.T1059.011 · LuaLucidRook embeds a Lua execution environment and runs second-stage payloads as Lua bytecode.T1082 · System Information DiscoveryLucidRook collects system information including user and computer names.T1105 · Ingress Tool TransferLucidRook retrieves second-stage Lua bytecode payloads.T1518 · Software DiscoveryLucidRook collects information about installed applications.T1560.001 · Archive via UtilityCollected reconnaissance data is stored in password-protected archives.T1566.001 · Spearphishing AttachmentThe October 2025 campaign used spear-phishing emails carrying password-protected archives.T1574.002 · DLL Side-LoadingLucidPawn deployed a legitimate executable renamed to mimic Microsoft Edge alongside DismCore.dll to sideload LucidRook.
Threat Actors
Malware
LucidPawnUAT-10362, used password-protected archives and dual infection chains that sideloaded LucidRook via a LucidPawn dropper while leveraging Lua bytecode for flexible, stealthy payload updates.LucidRookCisco Talos researchers tracked a new Lua-based modular backdoor called LucidRook used in October 2025 spear-phishing campaigns against NGOs and universities in Taiwan.
Products
GmailCollected reconnaissance is RSA-encrypted, archived with passwords, and exfiltrated via FTP or Gmail GMTP using a related tool called LucidKnight.Microsoft EdgeCisco Talos observed that LucidPawn decrypts and deploys a legitimate executable renamed to mimic Microsoft Edge, along with a malicious DLL (DismCore.dll) for sideloading LucidRook.Trend Micro Worry-Free Business Security Servicesand an EXE-based chain that leveraged a fake antivirus executable impersonating Trend Micro Worry-Free Business Security Services.