TLDR Tech / InfoSec
New ‘LucidRook' Malware Used in Targeted Attacks on NGOs, Universities
LucidRook is a Lua-based backdoor that targeted Taiwanese NGOs and universities via two October 2025 spear-phishing chains: an LNK-based chain where a password-protected archive drops a decoy government letter alongside a LucidPawn dropper that DLL-sideloads LucidRook via a renamed Microsoft Edge executable, and an EXE-based chain using a fake Trend Micro installer to achieve the same outcome. Once running, LucidRook fetches a second-stage Lua bytecode payloads from C2 (hosted briefly and removed post-delivery to hinder forensics), collects system reconnaissance data, RSA-encrypts it into password-protected archives, and exfiltrates via FTP, while a companion tool LucidKnight abuses Gmail GMTP for data exfiltration. Defenders should hunt for DismCore[.]dll sideloading, outbound FTP from non-server workloads, and anomalous Gmail API traffic from endpoints as initial detection anchors.
Read the full story