UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns
2026-04-09T19:24:17Z•5053a79bbcf1c34135154b434329ac5a94293863e519f40abf01ffda783d5daf
APTAPT28Adobe ReaderCVE-2024-41110CVE-2025-59528CVE-2026-34040ChaosComfyUIDDoS-for-hireDockerFlowiseGPUBreachLuaLucidRookMasjesuPRISMEXRowhammerbotnetcryptominingmalwareprivilege-escalationspear-phishingstagersupply-chain-compromise','malicious-packages','npm','PyPI','Go'zero-day
What happened
A broad set of active campaigns and high-impact vulnerabilities were reported: a newly observed threat cluster (UAT-10362) is using spear-phishing to deliver a Lua-based stager called LucidRook to Taiwanese NGOs and suspected universities; a previously unknown Adobe Reader zero-day has been exploited since at least Dec 2025; Flowise (CVE-2025-59528, CVSS 10.0) is under active exploitation for remote code execution across thousands of exposed instances; and Docker Engine suffers an authz-bypass (CVE-2026-34040) enabling potential host access (related to an incomplete fix for CVE-2024-41110). In
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 5053a79bbcf1c34135154b434329ac5a94293863e519f40abf01ffda783d5daf
- Enrichment time
- 2026-04-09T19:24:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.