Historical intelligence backfill. This assessment covers reporting originally published on 2026-04-08 and was added to the RWP archive on 2026-09-07.
LucidRook only runs if the box looks like Taiwan — Lua stager, fake AV, printers' FTP as C2
Talos 8 April 2026 — UAT-10362 spear-phish against Taiwan NGOs and suspected universities. LucidPawn geofences Traditional Chinese. LucidRook embeds Lua+Rust in a DLL. C2 on compromised Taiwanese print-shop FTP with creds on the company website.
Bottom line up front
CONFIRMED 8 April 2026 Cisco Talos — UAT-10362 spear-phish against Taiwanese NGOs and suspected universities, delivering LucidRook, a new stager: Lua interpreter plus Rust libraries inside a DLL, then staged Lua bytecode. Dropper LucidPawn runs only in Traditional Chinese / Taiwan-looking locales — region-specific anti-analysis, not a mass worm. Two chains: LNK and EXE, both dressed as antivirus. Actor abused an OAST service and compromised FTP servers (Talos: Taiwanese printing companies with credentials published on their own sites) for C2 and exfil. LucidKnight recon via Gmail precedes some full infections. October 2025 NGO phish appeared to ride authorized mail infrastructure.
This is espionage-shaped targeting, not ransomware. Do not call it OT because a university has a lab.
What happened
Password-zip, fake Trend Micro-style installer, locale check, Lua stage, FTP.
Why it matters
“Our FTP password is on the contact page” is still an APT C2. Locale gating means your Munich SOC sample may never detonate.
What is confirmed vs not
CONFIRMED Talos families, locale gate, FTP, NGO/university victim class.
UNKNOWN nation-state name beyond UAT-10362.
What defenders should do
- Taiwan NGOs/universities: block fake-AV LNK/EXE; don’t unpack emailed zips.
- Hunt public FTP creds on corporate sites.
- Detonate Taiwan-locale sandboxes or you will false-negative LucidPawn.
RWP assessment
Confidence: High on Talos. The interesting control is the locale check, not the Lua trivia.
Historical intelligence backfill. This assessment covers reporting originally published on 2026-04-08 and was added to the RWP archive on 2026-09-07.
Sources
- Cisco Talos — LucidRook Taiwan
- Broadcom — LucidRook protection bulletin
- iThome — 臺灣 NGO、大學 LucidRook