Malware
LucidPawn
- First Reported
- Apr 9, 2026
- Latest Reported
- Apr 10, 2026
Reported Context (2)
- UAT-10362, used password-protected archives and dual infection chains that sideloaded LucidRook via a LucidPawn dropper while leveraging Lua bytecode for flexible, stealthy payload updates. Cisco Talos Links LucidRook to Phishing Attacks on Taiwanese NGOs and Universities
- The attackers use RAR/7âZip lures to deliver a LucidPawn dropper that leverages DLL sideâloading in LNK- and EXE-based chains to launch a heavily obfuscated 64-bit LucidRook DLL that embeds a Lua interpreter, UAT-10362 Uses LucidRook Malware in Spear-Phishing Campaigns Targeting Taiwanese NGOs
Malware (2)
People (1)
Threat Actors (1)
MITRE ATT&CK (14)
Products (5)
Tools (1)
Industries (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.