A threat group tracked as UAT-10362 has been running targeted spear-phishing attacks against Taiwanese NGOs and universities since at least October 2025, deploying a novel modular malware called LucidRook. The malware uses an embedded Lua interpreter to let attackers retool their attack logic per target without rewriting core code, making detection and forensic analysis significantly harder. Organizations with ties to Taiwanese civil society, academic institutions, or regional policy work face elevated risk of data exfiltration through channels that bypass standard network controls.