A new piece of malware written in Lua, named LucidRook, is being used in targeted phishing attacks against NGOs and universities in Taiwan.

Cisco Talos researchers believe the malware is the work of a threat actor they call UAT-10362, describing them as a skilled group with “mature operational tradecraft.”

LucidRook was seen in attacks during October 2025, using phishing emails with password-protected files.

The researchers found two ways the malware was installed: one using an LNK shortcut file that led to a malware dropper called LucidPawn, and another using an EXE file that pretended to be Trend Micro Worry-Free Business Security Services antivirus software.

The LNK-based attack uses fake documents, such as letters made to look like they’re from the Taiwanese government, to distract the user.

Cisco Talos saw that LucidPawn decrypts and deploys a real program that’s been renamed to look like Microsoft Edge, along with a malicious DLL file (DismCore.dll) which allows LucidRook to be sideloaded.

LucidRook stands out because of its modular design and built-in Lua runtime environment, which allows it to download and run second-stage payloads as Lua bytecode.

This lets the attackers update its features without changing the core malware, and also makes it harder to analyze. This stealth is improved through extensive code obfuscation.

“Including the Lua interpreter transforms the DLL into a reliable running platform, enabling the attacker to modify or customize the malware’s behavior for different targets or attacks by updating the Lua bytecode payload, making development easier and more adaptable,” Cisco Talos explains.

“This also boosts security for the attackers, since the Lua stage can be quickly hosted and removed from the command-and-control server after delivery. Also, it can complicate investigations if security teams only find the loader without the Lua payload that was delivered separately.”

Talos also points out that the malware hides its embedded text, file extensions, internal names, and command-and-control addresses, making reverse-engineering difficult.

When LucidRook runs, it gathers system information, including user and computer names, installed programs, and running processes.

The data is encrypted with RSA, put into password-protected archives, and sent to the attacker’s servers through FTP.

While studying LucidRook, Talos researchers found another tool called “LucidKnight,” which is likely used to collect data.

A key feature of LucidKnight is its use of Gmail’s GMTP to send out the collected data, implying that UAT-10362 uses a versatile set of tools to meet different needs.

Cisco Talos is reasonably sure that the LucidRook attacks are part of a targeted intrusion. Because they couldn’t capture and decrypt the Lua bytecode fetched by LucidRook, they don’t know the exact actions taken after the initial infection.