> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Romulus campaign exploits Siemens Software Center CVE-2026-110936 via ClickFix - URL: https://f4n6.co.uk/security-feed/romulus-campaign-exploits-siemens-software-center-cve-2026-110936-via-clickfix/ - Published: 2026-10-20T21:19:58.000Z - Updated: 2026-10-20T21:19:58.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-110936, Romulus ## 1\. Executive summary Siemens has confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, which carries a CVSS v4.0 score of 8.4 (HIGH) and a CWE-427 uncontrolled search path classification. The flaw is not in CISA KEV and EPSS records 0%, so exploitation is targeted rather than opportunistic; the risk comes from the campaign, not the score. Attackers ship a genuine, validly signed Siemens Software Center 3.5.8.7 alongside their own DLLs inside a trojanized installer, AllMyBasic.msi, distributed outside official channels and linked to the Romulus multi-platform ClickFix delivery platform. EMEA financial services firms that permit user-installed software, or that run Siemens Software Center below 4.0.9.8, should treat any host that executed the installer as compromised and act on the containment steps in §4. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | A signed third-party application on the estate was used as a DLL side-loading carrier and delivered a loader with Chrome credential theft (LegionLoader) via the ROMULUS platform | The ICT-related incident management process must cover detection, containment and eradication of a trusted-binary abuse path, not only malware signatures; isolate, stop the process, remove start-up entries and reset credentials per §4 | | DORA Art. 28 | The attack depends on Siemens Software Center, a third-party vendor product, and on the vendor's 4.0.9.8 fix and 19 October exploitation notice | Third-party risk management must track the vendor advisory and confirm the fixed version is deployed; the vendor's own statement that no Siemens system or update channel was breached does not remove the client's duty to verify its own installations | | NIS2 Art. 21(2)(d) | The delivery chain is a trojanized MSI (AllMyBasic.msi) spread outside official channels, exploiting the trust in a signed vendor binary | Supply chain security measures must include controls on software sourcing and on side-loading of unsigned DLLs next to signed executables, and detection for msiexec launching SiemensSoftwareCenter.exe from AppData\\Local\\Programs | ## 3\. Technical analysis & attack chain The exploitation path is confirmed by Siemens and corroborated by Forescout Vedere Labs reporting on the ROMULUS panel. The steps below are those the sources describe; where a step rests on a single source it is marked. 1. A user is lured into a ClickFix prompt, a fake "I am not a robot" check that instructs them to paste and run a command. ClickFix delivers malware without a browser download or a file the user opens, which is why email and endpoint filtering alone do not stop it. 2. The pasted command retrieves and runs a PowerShell staging script served by the ROMULUS panel (Forescout, single-sourced). 3. The panel delivers a trojanized MSI installer, AllMyBasic.msi, carrying a malware loader. The installer was spread outside official channels. 4. The MSI places a genuine, validly signed copy of Siemens Software Center 3.5.8.7 next to attacker-supplied DLLs. The executable itself is not tampered with. 5. Siemens Software Center 3.5.8.7 loads helper files from its own folder without validating them (CWE-427, uncontrolled search path element). The attacker DLL is loaded and executes with the privileges of the application. 6. The loader delivers follow-on payloads. One analysed payload, LegionLoader, collects sensitive information stored in victims' Chrome browsers (Forescout, single-sourced). The vulnerability mechanism is DLL side-loading through an uncontrolled search path. The affected component is Siemens Software Center, the tool for downloading, installing and managing Siemens software. Version 3.5.8.7, the latest at the time of the campaign, is vulnerable; version 4.0.9.8 resolves it. The CVSS v4.0 score is 8.4\. NVD classifies the flaw as CWE-427 and describes the precondition as an authenticated local attacker able to place a crafted DLL in a searched directory; the campaign meets that precondition by shipping the DLL alongside the signed binary inside the installer. Persistence, privilege escalation, command-and-control and lateral movement are not described in the sources beyond the loader and the staging script. The loader's persistence mechanism is not given. No C2 domains, ports or protocols are published in the material provided. Do not assume a specific persistence location; hunt for the process and start-up entries named in §4. Attribution to "Romulus" is unconfirmed. No MITRE ATT&CK profile exists for an actor of that name, and Forescout states the identity of the operator behind the platform and common ownership of the final malware families are unknown, offering several possibilities (private panel, commercial delivery service, affiliate framework, or copied software). Treat "Romulus" as a label for a delivery platform, not a profiled actor. The link between the campaign and the ROMULUS panel rests on one shared IP address, 2.27.248\[.\]127, listed by both Siemens and Forescout; that is a single-source correlation and should be verified before it is used for blocking decisions. ## 4\. Mitigation & containment P1 (within 24 hours) - Hunt for SiemensSoftwareCenter.exe launched by msiexec from AppData\\Local\\Programs. Any host matching this is a suspected compromise; isolate it from the network. - On confirmed hosts, stop the SiemensSoftwareCenter.exe process, remove its start-up entries, and reset credentials for the affected user and any account that logged on to the host. - Block the attacker infrastructure listed in the Siemens blog post, including 2.27.248\[.\]127\. This IP is single-sourced as a distribution channel and shared with Forescout's panel list; verify against your own telemetry before a permanent block. - Push the fixed version. Siemens Software Center 4.0.9.8 resolves the issue, and existing installations update automatically the next time they launch. Confirm the version on every endpoint that has the product installed. P2 (within 72 hours) - Restrict or monitor msiexec execution that spawns signed vendor binaries from user-writable paths (AppData\\Local\\Programs). Add an EDR rule alerting on SiemensSoftwareCenter.exe with a parent of msiexec.exe. - Enforce a policy that users never paste commands from a web page into Win+R, the Run box or PowerShell, and that a legitimate "I am not a robot" check never asks for this. Brief service desk and end users on the ClickFix pattern. - Restrict software installation to official channels. Siemens advises downloading its software only from official sources; block execution of MSI files sourced from outside the managed software catalogue. P3 (within 7 days) - Review endpoint controls for DLL side-loading: alert on unsigned DLLs loaded from the same directory as a signed executable, and on writes to AppData\\Local\\Programs by non-installer processes. - Where Siemens Software Center is not required on a host, remove it to reduce the signed-binary carrier surface. - Confirm Chrome credential stores on affected hosts are treated as exposed; LegionLoader targets data stored in Chrome, so rotate any credentials saved in the browser. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ------------------------------------------- | ------------------------------------------------------------------- | ------------------------------- | | ipv4 | 2.27.248\[.\]127 | medium (single-source correlation; listed by Siemens and Forescout) | Help Net Security / Forescout | | filename | AllMyBasic.msi | high | Siemens via Help Net Security | | filename | SiemensSoftwareCenter.exe | high | Siemens via Help Net Security | | path | AppData\\Local\\Programs | high | Siemens via Help Net Security | | process | msiexec launching SiemensSoftwareCenter.exe | high | Siemens via Help Net Security | | malware | LegionLoader | medium (single-source, Forescout) | Forescout via Help Net Security | ```iocs ipv4 2.27.248[.]127 filename AllMyBasic.msi filename SiemensSoftwareCenter.exe path AppData\Local\Programs process msiexec -> SiemensSoftwareCenter.exe malware LegionLoader ``` No file hashes are published in the sources. The six IP addresses Forescout identified for the ROMULUS panel are not enumerated in the material provided; only 2.27.248\[.\]127 is named. Obtain the full list from the Siemens blog post and the Forescout report before enforcement. ## 6\. Detection The sources give process and path artefacts rather than file content, so a Sigma rule on process creation is the reliable detection. A YARA rule is included on the named artefacts (installer filename, carrier executable, user-writable path); these are weak on their own and should be scoped to the parent-process context. ```yaml title: Siemens Software Center DLL Side-Loading via msiexec from AppData id: 8f3c2a10-romulus-siemens-2026 status: experimental description: Detects msiexec launching SiemensSoftwareCenter.exe from a user-writable AppData path, consistent with CVE-2026-110936 ClickFix delivery author: Adverse Trace date: 2026/10/20 references: - https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/ logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: '\msiexec.exe' selection_image: Image|endswith: '\SiemensSoftwareCenter.exe' selection_path: Image|contains: '\AppData\Local\Programs\' condition: selection_parent and selection_image and selection_path falsepositives: - Legitimate Siemens Software Center installed per-user under AppData level: high ``` ```yara rule SiemensSoftwareCenter_SideLoad_Carrier { meta: author = "Adverse Trace" date = "2026-10-20" reference = "https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/" description = "Flags the named carrier executable and installer artefacts from the Romulus ClickFix campaign; weak strings, scope to parent-process context" strings: $exe = "SiemensSoftwareCenter.exe" ascii wide nocase $msi = "AllMyBasic.msi" ascii wide nocase $path = "AppData\\Local\\Programs" ascii wide nocase condition: uint16(0) == 0x5A4D and 2 of them } ``` ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-110936](https://nvd.nist.gov/vuln/detail/CVE-2026-110936?ref=f4n6.co.uk) | 8.4 High | — | 0% | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynami… | ## 7\. Sources - Help Net Security, "Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign", https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/, 2026-10-20. - The Hacker News, "ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan", https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html. - NVD, CVE-2026-110936 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-110936. - Siemens security advisory and exploitation blog post (referenced by Help Net Security, 15 and 19 October 2026); the direct URLs are not given in the material provided. - Forescout Vedere Labs, ROMULUS panel report (referenced by Help Net Security, week of 2026-10-13); the direct URL is not given in the material provided. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-110936 at CVSS 8.4 HIGH, not in CISA KEV, EPSS 0%, with exploitation confirmed by Siemens and the risk driven by the ClickFix delivery chain rather than the score. The attribution to "Romulus" is unconfirmed: no MITRE ATT&CK profile exists for that name, and Forescout states the operator identity is unknown, so we treat it as a delivery-platform label. The link between the campaign and the ROMULUS panel rests on a single shared IP and is single-sourced; verify before enforcement. Client impact is highest for firms that allow user-installed software or run Siemens Software Center below 4.0.9.8, where a signed-binary carrier can deliver a loader with Chrome credential theft. We will monitor for the full ROMULUS IP list and any published hashes, and update this advisory when Siemens or Forescout release them. --- [Read the original source →](https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*