Taiwan high‑speed rail was disrupted after a 23‑year‑old student spoofed signals and triggered an emergency alarm, stopping four trains for nearly an hour.

Taiwan high‑speed rail system, one of the most important pieces of national infrastructure, was thrown into chaos during the Qingming Festival holiday when several trains suddenly came to an unexpected halt. Experts initially investigated a technical glitch but soon discovered the incident was caused by a cyber intrusion carried out by a 23-year-old university student.

“The Ministry of Transportation and Communications yesterday pledged to submit a report on ways to harden the communication security of railway systems after a university student hacked into Taiwan High Speed Rail Corp’s (THSRC) radio communications system and disrupted operations of four high-speed rail trains last month.” reported the Taipei Times. “Investigation by the police and prosecutors found that the university student and radio enthusiast, surnamed Lin (林), first used a software-defined radio (SDR) filter to analyze THSRC signals, downloaded the data to a computer, cracked the parameters and then programmed the codes into his radio devices.”

Authorities revealed that the student, identified only by his surname Lin, used radio equipment and software tools bought online to imitate the communication signals used inside Taiwan High-Speed Rail (THSR). By doing so, he triggered a general emergency alarm, forcing train operators to stop four trains, disrupting service for nearly an hour and delaying hundreds of passengers heading home from the holiday.

The student exploited weaknesses in TETRA, the radio communication system used by THSR for nearly two decades. Before transmitting anything, Lin reportedly intercepted and decoded the system’s parameters using software‑defined radio (SDR) tools. He analyzed the structure of the signals, then programmed the same parameters into handheld radios to impersonate legitimate THSR beacons.

Using these cloned signals, he sent a high‑priority “General Alarm” message. In the THSR safety protocol, this alarm is treated as a potential life‑or‑death alert: trains in the affected zone must immediately switch to manual emergency stop mode. The attack caused three trains to stop instantly, and a fourth received the same instruction shortly after. In total, THSR recorded 48 minutes of disruption.

What stood out most to investigators was not the complexity of the act, but the long‑standing vulnerability that made it possible. Local reports highlight that the same system parameters had been used for 19 years and were never rotated. This meant that once Lin decoded the information, nothing prevented him from reusing it without detection.

Police say Lin also received help from a 21‑year‑old acquaintance, who provided some of the technical details needed for the intrusion.

Once THSR staff realized the alarm did not match any assigned radio device, they checked their equipment and quickly concluded that the signal must have come from an unauthorized source. They contacted police, who examined station CCTV and radio network logs.

These traces eventually led investigators to Lin’s residence, where they recovered 11 handheld radios, an SDR receiver, and a laptop used for the attack.

The police arrested the student on April 28 and later released him on NT$100,000 bail, pending further investigation.

Prosecutors say Lin may have violated several laws, including articles dealing with interference with public transportation, use of unauthorized equipment, and exploiting vulnerabilities in a protected computer system. Together, the charges could result in up to 10 years in prison.

Beyond the dramatic nature of the event, the hack has sparked a broader debate in Taiwan. Politicians and cybersecurity experts questioned how a national high-speed rail system, carrying more than 80 million passengers a year, could be compromised using consumer‑grade hardware.

Investigators emphasized that even if Lin intended the act as a prank, interfering with public transportation is dangerous and illegal. The District Prosecutors Office warned that any disruption to transport networks will be prosecuted aggressively to protect public safety.

The incident ultimately highlights a simple truth: in a world where cheap radio tools and open‑source software are widely accessible, even long‑trusted systems must be updated and continuously tested. Otherwise, critical infrastructure remains exposed, not only to hostile actors, but to anyone curious enough to experiment.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Taiwan high‑speed rail)

LucidRook is Lua malware used in phishing attacks on NGOs and universities in Taiwan, linked to UAT-10362, spread via password-protected emails.

LucidRook is a new Lua-based malware used in targeted phishing attacks against NGOs and universities in Taiwan. Cisco Talos links it to a skilled group tracked as UAT-10362. In Oct 2025, attackers used password-protected email attachments to spread the malware in spear-phishing campaigns.

“Cisco Talos observed a spear-phishing attack delivering LucidRook, a newly identified stager that targeted a Taiwanese NGO in October 2025. The metadata in the email suggests that it was delivered via authorized mail infrastructure, which implies potential misuse of legitimate sending capabilities.” reads the report published by Cisco Talos. “The email contained a shortened URL that leads to the download of a password protected and encrypted RAR archive. The decryption password was included in the email body. Based on this email and the collected samples, Talos observed two distinct infection chains originating from the delivered archives.”

The phishing emails came from likely legitimate infrastructure and included shortened links to password-protected RAR archives, with passwords inside the message.

The archives contained fake government or security-related decoy documents to distract victims.

The researchers observed two infection chains: one LNK-based and one EXE-based.

The LNK infection chain starts when a shortcut file from a phishing archive is opened, triggering the LucidPawn dropper hidden in nested folders. It uses LOLBAS techniques and PowerShell to run code through trusted Windows tools, reducing detection. LucidPawn decrypts payloads, including a legitimate DISM executable disguised as a trusted app and the LucidRook stager. It abuses DLL sideloading to load malicious code via the signed DISM binary. The malware also opens decoy documents to distract the user. Persistence is achieved by placing a malicious LNK in the Startup folder, ensuring execution at reboot.

The second infection chain uses a standalone EXE dropper written in .NET, distributed inside password-protected archives disguised as legitimate security software. When executed, it decodes embedded Base64 payloads and drops multiple files, including a legitimate DISM executable, the LucidRook stager, and a Startup LNK for persistence. The DISM binary is abused for sideloading the malware, while the dropper impersonates trusted security tools and shows a fake completion message to mislead the victim.

Both chains aim to deliver LucidRook and maintain stealth on targeted Taiwanese systems.

“LucidRook is a sophisticated 64-bit Windows DLL stager consisting of a Lua interpreter, embedded Rust-compiled libraries, and Lua bytecode payload. The DLL embeds a Lua 5.4.8 interpreter and retrieves a staged payload (in our sample named archive1.zip) from its C2 over FTP.” continue the report. “After unpacking and validating the downloaded stage, the implant loads and executes the resulting Lua bytecode on the compromised host.”

LucidRook is a complex malware that embeds a Lua 5.4.8 interpreter inside a large Rust-based DLL, turning it into a flexible execution platform. The malicious code downloads encrypted Lua bytecode from its command and control server, verifies it, and runs it locally, allowing operators to quickly change behavior per target. The DLL is hard to analyze due to thousands of functions and stripped components. On execution, it first collects system data like usernames, processes, and installed software, then encrypts and exfiltrates it. It uses RSA and password-protected ZIP files for protection. Communication happens over FTP using stolen or exposed credentials, often abusing public servers from companies with open upload services. The malware also hides strings using multi-stage XOR and address calculation tricks. Payloads are protected with different passwords and keys per campaign for modular deployment now

Talos also detailed LucidPawn, a dropper linked to LucidRook, sharing Rust code, obfuscation, and COM DLL masquerading. Upon execution, it queries a DNS OAST service (dnslog[.]ink) to confirm infection without attacker infrastructure. It uses geo-targeting, checking Windows UI language and only runs on Traditional Chinese systems (Taiwan/HK), avoiding sandboxes. The researchers also spotted a variant that only drops payloads and installs LucidKnight. LucidKnight is a recon tool that gathers system data, encrypts it, and exfiltrates email Gmail SMTP sending ZIP attachments disguised as ‘Sports Information Platform’. This shows a modular toolkit using different components per mission.

Talos has not yet recovered a decryptable Lua bytecode payload used by LucidRook, but is publishing its findings to enable early detection. They hope sharing this information will help the security community identify additional indicators, improve clustering of related activity, and support future attribution efforts.

“Based on the tactics, techniques, and procedures (TTPs) and the level of engineering investment observed across these infection chains, we assess with medium confidence that this activity reflects a targeted intrusion rather than broad, opportunistic malware distribution.” concludes the report. “Delivery via spearphishing, combined with LucidRook’s sophisticated design, suggests a sophisticated threat actor prioritizing flexibility, stealth, and victim-specific tasking.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Taiwan)