Siemens Software Center DLL side-loading flaw CVE-2026-110936 exploited in Romulus ClickFix malware campaign

Linha do tempo

1. gbhackers.com ↗ · pub. 22/10/2026 06:05 · coletado 22/10 08:00

   Siemens Software Center DLL side-loading flaw CVE-2026-110936 actively exploited in Romulus ClickFix campaign

   Adds the advisory ID SSA-580366 (published October 15), the CVSS 3.1 score of 6.7 alongside 8.4 under v4.0, the CWE-427 classification, Siemens' statement that it knows of no breach of its systems or update infrastructure, the inactive status of 2.27.248[.]127 (which hosted AllMyBasic.msi), unverified infrastructure status, and the msiexec parent-process hunting indicator.

   ler a análise desta fonte ocultar

   Adds the advisory ID SSA-580366 (published October 15), the CVSS 3.1 score of 6.7 alongside 8.4 under v4.0, the CWE-427 classification, Siemens' statement that it knows of no breach of its systems or update infrastructure, the inactive status of 2.27.248[.]127 (which hosted AllMyBasic.msi), unverified infrastructure status, and the msiexec parent-process hunting indicator.

   Siemens has confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw (CWE-427) in Siemens Software Center. Attackers ship an unmodified, validly signed Siemens executable alongside malicious DLLs, so the code runs through a legitimate application. The report attributes the activity to the Romulus multi-platform ClickFix campaign. Siemens published advisory SSA-580366 on October 15 and fixed the issue in version 4.0.9.8. Siemens says it is not aware of any breach of its systems, products or update infrastructure.

   Technical Details

   • CVSS is 6.7 (v3.1) and 8.4 (v4.0). The observed delivery used Software Center 3.5.8.7, which loaded attacker-supplied helper libraries from its own directory without verification.
   • The Siemens binary keeps its valid signature, while the malicious functionality sits in adjacent DLLs (archive.dll is named as malicious). Checking only the executable's signature misses the threat.
   • Infrastructure: 96.62.218[.]59 and wizardexpensive[.]com are reported as active payload-hosting and C2 endpoints. 2.27.248[.]127 is inactive and previously hosted the AllMyBasic.msi bundle. These statuses come from the supplied report and have not been independently verified.
   • Hunting indicators:
     • Unexpected Siemens Software Center startup entries or scheduled tasks.
     • SiemensSoftwareCenter.exe running from AppData\Local\Programs, especially when launched by msiexec.
     • An SM Software Provisioning Service directory under that folder.
     • Files activate.bak or statinfosta.DB next to the executable.
     • An FTSuite directory containing ftc.uml under AppData\Local.
   • The social engineering aspect is ClickFix: victims are lured into pasting commands into Windows Run or PowerShell.

   Remediation

   • Update to version 4.0.9.8. Existing installations update automatically at next startup, so administrators should verify the version.
   • Block the reported infrastructure and review historical connections, including to the inactive distribution address.
   • If compromise is suspected, isolate the endpoint, terminate malicious processes, investigate persistence and follow incident response procedures. Updating does not replace investigating already-affected systems.
   • Download installers only from official Siemens sources and never paste website commands into Run or PowerShell.
2. infosecurity-magazine.com ↗ · pub. 20/10/2026 07:45 · coletado 20/10 16:31

   Siemens Software Center DLL side-loading flaw CVE-2026-110936 exploited in Romulus ClickFix malware campaign

   This article adds Siemens' host-based indicators of compromise (the `SM Software Provisioning Service` folder, `activate.bak` and `statinfosta.DB` files, the `FTSuite`/`ftc.uml` artifacts and rogue start-up/Task Scheduler entries). It also adds Siemens' incident response guidance (isolate, stop the process, remove persistence, reset passwords) and its advice to detect on folder and behavior rather than file hash. It also gives the date Forescout identified Romulus (October 14) and the date of the Siemens blog (October 19).

   ler a análise desta fonte ocultar

   This article adds Siemens' host-based indicators of compromise (the SM Software Provisioning Service folder, activate.bak and statinfosta.DB files, the FTSuite/ftc.uml artifacts and rogue start-up/Task Scheduler entries). It also adds Siemens' incident response guidance (isolate, stop the process, remove persistence, reset passwords) and its advice to detect on folder and behavior rather than file hash. It also gives the date Forescout identified Romulus (October 14) and the date of the Siemens blog (October 19).

   Siemens warned customers that attackers are actively exploiting CVE-2026-110936 (CVSS 8.4), a DLL side-loading vulnerability in Siemens Software Center, to distribute malware. The activity is attributed to the Romulus multi-platform ClickFix campaign. Romulus is a server hosting panel identified by Forescout researchers on October 14 that lets cybercriminals deploy ClickFix tactics across an ecosystem and repeatedly deliver multiple kinds of malware. Siemens published its advisory blog on October 19 and urged customers to update to version 4.0.9.8.

   Technical Details

   • Attackers use a genuine, validly signed copy of Software Center and place malicious DLLs next to it. Version 3.5.8.7 loaded helper files from its own folder without checking them.
   • Victims are lured with ClickFix social engineering into pasting commands (Win+R, Run box or PowerShell). The malicious code then runs with the privileges of the affected application.
   • Indicators of compromise listed by Siemens:
     • "Siemens Software Center" in start-up apps or Task Scheduler on a PC that never had it installed.
     • A folder named SM Software Provisioning Service in AppData\Local\Programs, created by the malware.
     • Files activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
     • A folder FTSuite containing ftc.uml in AppData\Local.
     • Network connections to 96.62.218[.]59.
   • Detection should focus on the folder location and suspicious behavior, not the Siemens file fingerprint, because the binary itself is genuine.

   Remediation

   • Update Software Center to 4.0.9.8. Existing installations update automatically the next time they start.
   • Never paste commands from a web page into Win+R, the Run box or PowerShell.
   • If compromise is suspected, isolate the device, stop the process first, then remove the start-up entry and scheduled task and reset passwords.
   • Download Siemens software only from official Siemens sources, and block the IP address and domain listed in the Siemens advisory.
3. thehackernews.com ↗ · pub. 20/10/2026 04:11 · coletado 20/10 05:00

   ClickFix Romulus Campaign Abuses Siemens Software Center DLL Sideloading Flaw (CVE-2026-110936) to Deploy RAT

   ler a análise desta fonte ocultar

   Siemens patched a high-severity DLL sideloading vulnerability, CVE-2026-110936 (CVSS v4 8.4), in Siemens Software Center that has been exploited in ClickFix attacks. Threat actors abused a genuine, validly signed copy of the application (v3.5.8.7) and placed a crafted archive.dll beside it, so the trusted binary loaded the malicious library from its own folder. The activity is attributed to a ClickFix delivery platform called Romulus, which Forescout detailed the prior week as delivering Legion Loader and other malware via DLL sideloading. Huntress reports some campaigns used malicious ChatGPT Custom GPTs to steer victims to a fake URL serving the ClickFix lure, ultimately deploying a remote access trojan.

   Technical Details

   • The application loads DLLs from an uncontrolled search path, enabling arbitrary code execution with the privileges of the affected application.
   • Infection chain: the victim copies and runs a ClickFix lure, which executes PowerShell to drop an MSI installer. msiexec.exe launches AllMyBasic.msi, which executes SiemensSoftwareCenter.exe and sideloads archive.dll, leading to RAT deployment.
   • Siemens-shared IOCs: 96.62.218[.]59 and wizardexpensive[.]com (payload hosting and C2); 2.27.248[.]127 (distribution of AllMyBasic.msi).
   • The flaw was reported by Huntress Labs researcher Jose Oregon.

   Remediation

   • Update Siemens Software Center to version 4.0.9.8 or later and launch the application to apply the update.
   • Block the listed IP addresses and domains.
   • Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe.
4. securityweek.com ↗ · pub. 19/10/2026 15:15 · coletado 19/10 17:53 primeiro registro

   Siemens Software Center DLL flaw CVE-2026-110936 exploited in Romulus ClickFix malware campaign

   ler a análise desta fonte ocultar

   Siemens disclosed on Monday that threat actors exploited CVE-2026-110936, a DLL search-path vulnerability in Siemens Software Center, in a malware campaign. The attackers bundled a legitimately signed copy of the Siemens program with their own malicious DLLs, which the program loaded from its own folder at startup. Siemens links the activity to Romulus, a multi-platform ClickFix delivery platform recently documented by Forescout. Siemens states that none of its systems, products or update channels were breached and that the malicious package was not distributed through its channels.

   Technical Details

   • The flaw stems from the program not properly restricting the locations searched for DLL files. An authenticated local attacker can plant a malicious DLL and execute code with the privileges of Software Center. Siemens rated it CVSS v4 8.4.
   • Version 3.5.8.7, the newest release at the time, did not validate the helper DLLs before loading them.
   • ClickFix attacks use fake prompts, such as bogus CAPTCHA checks, to trick users into pasting and running malicious commands.
   • Forescout found Romulus running on several servers, including the one Siemens identified as the distribution server for the malicious bundle. Romulus delivered LegionLoader and a trojanized installer that used a legitimate Stardock application for DLL side-loading. Forescout could not determine who runs Romulus.
   • Huntress described the same Stardock-based package in a late-September campaign that used rogue ChatGPT Custom GPTs to lure users to ClickFix pages. Signed Canon and later Stardock programs were abused to side-load code that ultimately deployed a RAT. Huntress responded to at least 40 incidents and believes signed programs from other vendors are probably being misused as well.
   • Siemens Software Center is not mentioned in the Huntress or Forescout reports. The overlapping infrastructure and similar side-loading approach suggest it was added to the same toolkit.
   • Siemens' blog post lists IoCs and signs of infection. Because the Siemens file is legitimate, Siemens advises focusing on suspicious behavior and malware-associated folders rather than file hashes.

   Remediation

   • Update to Software Center 4.0.9.8. Existing installations receive the fix automatically on next launch.
   • Use the IoCs and infection indicators in the Siemens blog post for hunting.
   • Prioritize behavioral detection of signed binaries side-loading DLLs from unusual folders over hash-based detection.