New Lua-based malware “Lucid Rook” observed in targeted attacks against Taiwanese organizations
Summary: Cisco Talos observed a spear-phishing campaign delivering a new stager called LucidRook against a Taiwanese NGO in October 2025, with emails sent through authorized mail infrastructure containing shortened URLs to password-protected RAR archives. The malware uses two infection chains - an LNK-based chain with a dropper tracked as LucidPawn that sideloads LucidRook via DLL search order hijacking, and a .NET EXE chain seen in samples uploaded to public repositories in December 2025. LucidRook is a 64-bit Windows DLL stager embedding a Lua 5.4.8 interpreter and Rust-compiled libraries that retrieves encrypted Lua bytecode from command-and-control servers over plaintext FTP.
What's compelling: The C2 servers were two Taiwanese printing companies that had publicly listed their FTP credentials on their own websites as part of a file-uploading service, turning ordinary small businesses into low-cost staging infrastructure - and because the Lua payload is hosted only briefly and then removed, defenders who recover the loader alone may have nothing left to reconstruct the attack from.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026