Lua - MITRE ATT&CK

Threat entity extracted from intelligence sources

Frequency
11
occurrences
First Seen
November 5, 2025
Last Seen
May 8, 2026

Lua is a mitre_attack tracked by ThreatCluster, appearing in 8 threat clusters built from 11 intelligence report mentions.

Lua is a mitre_attack tracked across 8 threat clusters and 11 intelligence report mentions on ThreatCluster. First observed November 5, 2025; most recent activity May 8, 2026.

Related Threat Clusters

Recent Intelligence Reports

  • USN-8262-1: Lua vulnerability — Ubuntu · May 8, 2026
  • 20-Year — Darkreading · April 27, 2026
  • Fast16: Cyberweapon that predates Stuxnet by five years — News.Ycombinator · April 26, 2026
  • Researchers find sabotage malware that may predate Stuxnet — Theregister · April 24, 2026
  • Ubuntu 24.04 Redis Critical Lua Denial of Service Vulnerability USN-8169 — Linuxsecurity · April 14, 2026
  • USN-8169-1: Redis, Lua vulnerabilities — Ubuntu · April 13, 2026
  • New 'LucidRook' malware used in targeted attacks on NGOs, universities — Bleepingcomputer · April 9, 2026
  • CVE-2022-33099 An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap — Api.Msrc.Microsoft · February 18, 2026

Frequently asked questions

What is Lua?

Lua is a mitre_attack tracked by ThreatCluster, appearing in 8 threat clusters built from 11 intelligence report mentions.

Is Lua still active?

The most recent intelligence report mentioning Lua on ThreatCluster is dated May 8, 2026. Activity was first observed November 5, 2025, giving a tracked span from then to May 8, 2026.

What is Lua associated with?

Across ThreatCluster reporting, Lua most frequently co-occurs with Apt28, APT41, APT42, Equation Group, Fancy Bear, among 12 tracked related entities.

What are the latest developments involving Lua?

The most significant recent cluster is “Discovery of Fast16 Malware: Precursor to Stuxnet Targeting Iranian Nuclear Program” (17 articles · Updated April 27, 2026). Lua appears across 8 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on Lua?

Lua appears in 11 intelligence report mentions across 8 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown