UAT-10362 Deploys LucidRook Lua-Based Malware Against Taiwanese NGOs and Universities — Threadlinqs Intelligence
As of 2026-05-30, UAT-10362 Deploys LucidRook Lua-Based Malware Against Taiwanese NGOs and Universities is a high-severity malware threat attributed to UAT-10362 (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-0345 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: UAT-10362 · China · ESPIONAGE
China-nexus threat actor UAT-10362 conducts spear-phishing campaigns against Taiwanese NGOs and universities using LucidRook, a novel Lua 5.4.8-based stager embedded in a 64-bit DLL with Rust-compiled
UAT-10362 is a previously undocumented China-nexus threat cluster first observed in October 2025 conducting targeted spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities. The actor deploys a sophisticated tiered malware toolkit consisting of LucidRook, LucidPawn, and LucidKnight, designed for targeted intelligence collection against civil society and academic institutions in Taiwan.
LucidRook is the primary stager: a 64-bit Windows DLL (~1.6MB, 3,800+ functions) that embeds a full Lua 5.4.8 interpreter alongside Rust-compiled libraries. It masquerades as a COM DLL via a DllGetClassObject export and downloads staged Lua bytecode payloads from compromised FTP servers. The stager implements a safe mode that disables package.loadlib and omits the debug library to harden against analysis. String obfuscation uses a two-stage scheme: per-string arithmetic address calculation followed by XOR decryption with a seed|mask key reconstruction. Host reconnaissance collects user accounts, computer names, driver information, installed applications, and running processes, encrypting results with an embedded RSA public key and packaging into password-protected ZIP archives (archive4.zip) uploaded to FTP C2.
LucidPawn serves as the initial dropper, sharing LucidRook''s COM DLL masquerade technique and obfuscation scheme. It performs geofencing via GetUserDefaultUILanguage(), checking for Traditional Chinese (0x0404/zh-TW) with a 0xF7FF mask that also accepts zh-HK (0x0C04), ensuring execution only on Taiwanese or Hong Kong systems. LucidPawn sends a DNS beacon to an Out-of-band Application Security Testing (OAST) service at d.2fcc7078.digimg.store to verify network connectivity, then decrypts AES-encrypted embedded binaries, establishes persistence via Startup folder LNK files, and launches LucidRook via DLL side-loading.
LucidKnight is a companion 64-bit Windows DLL reconnaissance tool with embedded Rust components. It collects computer name, OS version, processor architecture, CPU usage, running processes, and installed software, writing to four TXT files encrypted with a separate RSA public key. Exfiltration occurs via Gmail SMTP using the lettre Rust crate: the sender account fexopuboriw972@gmail.com transmits encrypted archive.zip to the temporary address crimsonanabel@powerscrews.com with a Traditional Chinese subject line.
Two distinct infection chains deliver the malware. The LNK-based vector uses password-protected RAR archives containing LNK files with substituted PDF icons and hidden directories nested four levels deep. The LNK targets the Pester framework Build.bat (a LOLBAS technique) to execute PowerShell, which launches the legitimate DISM binary index.exe. DLL search order hijacking loads the malicious DismCore.dll (LucidPawn), which decrypts embedded binaries to %APPDATA%\Local\Microsoft\Windows\Apps, renames the legitimate DISM executable to msedge.exe for persistence, and opens decoy documents. The EXE-based vector distributes 7-Zip archives containing Cleanup.exe, a .NET dropper masquerading as a Trend Micro product with a falsified compilation timestamp (2065-01-12). It Base64-decodes embedded files, drops the DISM executable and LucidRook stager to C:\ProgramData, creates a Startup LNK for persistence, and displays a fake cleanup completed message.
C2 infrastructure leverages two compromised FTP servers (1.34.253.131 and 59.124.71.242) belonging to Taiwanese printing companies whose FTP credentials were publicly exposed on their corporate websites. FTP operations use binary/passive mode with plaintext authentication. The actor generates different passwords and payloads per target using the shared C2 infrastructure, with payload archives protected by unique passwords and RSA encryption. The OAST service at dnslog.ink provides DNS beaconing without dedicated infrastructure.
Target sectors: government, ngo, education, civil-society, academia
Target regions: Taiwan, East Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1204, T1204, T1059, T1547, T1574, T1036, T1036, T1027