Red Team

ClickFix crew hides malware behind signed Siemens Software Center

Siemens confirms ROMULUS ClickFix attackers bundle its signed Software Center with malicious DLLs. How the tradecraft works and what to hunt for.

Crosshair target over a signed software icon, illustrating attackers abusing the signed Siemens Software Center in a ClickFix malware campaign

Siemens has confirmed that criminals are shipping a genuine, digitally signed copy of its Siemens Software Center alongside malicious DLLs, turning a trusted vendor binary into a malware launcher. The activity is tied to ROMULUS, a reusable ClickFix delivery platform that has already been seen abusing signed Stardock and Canon software and dropping LegionLoader.

What happened

On 19 October 2026 Siemens ProductCERT published a blog post confirming that attackers are exploiting CVE-2026-110936, a DLL side-loading weakness in Siemens Software Center, the Windows client customers use to install, activate and update licensed Siemens software. The flaw was first disclosed on 15 October in advisory SSA-580366, which carries a CVSS v4 score of 8.4, and is fixed in version 4.0.9.8. Existing installations pick up the fix automatically the next time the application starts.

Siemens says this is not a compromise of its own estate: to its knowledge, none of its systems, products or update channels were breached. Instead, attackers took an unmodified, validly signed copy of the program and packaged it with their own DLLs in an installer distributed outside Siemens channels. Version 3.5.8.7, the current release at the time, loaded helper libraries from its own folder without validating them, so the trusted executable obligingly ran the attacker’s code.

Siemens links the campaign to ROMULUS, which it describes as a multi-platform ClickFix operation. Jose Oregon of Huntress reported the flaw, and Siemens is sharing intelligence with EDR vendors and authorities.

The technical picture

ROMULUS was documented by Forescout’s Vedere Labs on 15 October, after researchers found its operator panel during an unrelated incident. Forescout found six servers exposing the same dark-themed ROMULUS login page and concluded it is a shared delivery backend rather than a single malware server. The operator is unidentified, and Forescout has seen no link to RomulusLoader, a separate family Proofpoint has tied to the Silver Fox group.

The front end is classic ClickFix. A victim lands on a page showing a fake verification or error prompt that persuades them to paste a command into the Windows Run box or PowerShell themselves. No exploit is needed to get the first stage running.

From there, ROMULUS issues short hexadecimal tokens that map to different payload routes. Forescout analysed two:

  • Signed-binary side-loading. An obfuscated PowerShell stager quietly installs a trojanised MSI into the user’s profile. Inside sits a legitimate Stardock executable paired with a patched DLL that pulls in a malicious loader. This is the same package Huntress reported in late September, when rogue ChatGPT Custom GPTs were used to steer people towards ClickFix pages, and Huntress had earlier seen a Canon application abused the same way.
  • LegionLoader via archives. A second stager fetches a password-protected 7z bundle plus the legitimate 7-Zip command-line tool, unpacks nested archives and runs an executable padded to roughly 842 MiB. The bloat sits in an oversized relocation section and compresses to almost nothing, helping it slip past scanner and sandbox size limits. The decrypted payload is LegionLoader (also tracked as CurlyGate, RobotDropper and Satacom), a loader active since 2019 that can pull Chrome browser secrets and run further commands.

The Siemens link becomes clear from the infrastructure. Siemens lists 2.27.248[.]127 among the addresses to block, and that same address appears in Forescout’s list of ROMULUS hosts. As SecurityWeek points out, neither the Forescout nor the Huntress reports mention Siemens, so the most reasonable reading is that the Siemens client has simply been added to the same rotating pool of signed carriers.

Flow diagram of the ROMULUS ClickFix attack chain from fake prompt to PowerShell stager, silent MSI install, signed binary side-loading and loader execution

Why it matters for UK organisations

None of the sources names UK victims, and I would not assume any. The relevance for UK defenders is the tradecraft, which is not tied to any one geography or sector. ClickFix lures work anywhere staff can be convinced to open a Run box, and the side-loading carrier list is now known to include products from Canon, Stardock and Siemens.

That matters because a great deal of detection logic, and many allow-listing policies, still give signed binaries from reputable vendors the benefit of the doubt. Siemens is widely used across UK manufacturing and engineering, so its name in a start-up entry is unlikely to raise eyebrows. Siemens itself warns defenders not to hunt on the hash of its executable, because the file is genuine.

Note too that the ROMULUS chain installs into the user’s own AppData folders, so a standard user account is not, on its own, a barrier.

Expert view

From the offensive side, none of this is novel. DLL search-order hijacking against signed applications has been a staple of red team initial access for years, because it borrows the reputation of the host binary.

What ROMULUS shows is the industrialisation of that idea. The operator has separated lure, staging and payload, uses tokens to swap routes on demand, and can rotate in a fresh signed carrier whenever an old one gets burned. Combine that with ClickFix, which neatly sidesteps attachment filtering and macro controls by making the user the execution engine, and you have a chain that defeats controls tuned to spot malicious documents or unsigned files.

In my experience the weak spots are almost always the same: PowerShell available to every user with no constraint, application control that trusts publisher rather than location, and nobody watching for signed programs running from odd folders.

What to do now

  1. Patch and verify. Make sure every Siemens Software Center install is on 4.0.9.8 or later. It updates on launch, so prompt users to open it, then confirm version numbers through your asset inventory (Cyber Essentials: security update management).
  2. Hunt using behaviour, not hashes. Siemens suggests checking for the Siemens executable started by msiexec from a Programs folder inside the user’s AppData, unexpected start-up items or scheduled tasks named after the product on machines that never had it, a folder called SM Software Provisioning Service, files named activate.bak or statinfosta.DB, and an FTSuite folder containing ftc.uml under AppData\Local.
  3. Block published indicators. Add 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 to firewall, proxy and DNS blocklists, and search historical logs. Load Forescout’s ROMULUS and LegionLoader indicators too.
  4. Constrain PowerShell and Run. Watch for PowerShell launched with hidden windows or execution policy bypass and a URL on the command line, and for URLs written as long decimal numbers rather than dotted addresses. Consider restricting the Run dialog and PowerShell for users who do not need them (Cyber Essentials: secure configuration).
  5. Tighten application control. Rules that trust any signed binary from a known publisher should also check where it runs from. Flag signed executables loading DLLs from user-writable directories, and very large executables written to temporary folders (Cyber Essentials: malware protection).
  6. Brief staff. No genuine “I am not a robot” check will ever ask anyone to paste a command.
  7. If you find it, isolate the host, stop the process, remove persistence and reset credentials, including browser-saved passwords, given LegionLoader’s interest in Chrome data.

Bottom line

Siemens did not ship malware; criminals borrowed its signature. The ROMULUS campaign is a reminder that a trusted publisher name tells you nothing about whether a binary should be running from a user’s profile. Patch the Siemens client, hunt on location and behaviour, and treat “paste this into Run” as the attack it is.

Sources

Related Posts