ROMULUS ClickFix delivery platform used to distribute Legion Loader and trojanized MSI payloads
Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). Forescout identified six IP addresses running ROMULUS, and the operator is unknown. The platform may be a privately run panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. Forescout reports no overlap with RomulusLoader, a malware family tied to Silver Fox (TA4922). The findings show ClickFix evolving from a social engineering technique into an effective malware entry point.
Technical Details
- ROMULUS exposes two endpoints that download a PowerShell staging script, which decides the next payload: a trojanized MSI installer carrying a malware loader, or an encrypted archive containing Legion Loader.
- Legion Loader contacts a remote server to fetch and run additional payloads.
- 96.62.224[.]81 hosted a ClickFix script and an MSI installer in a separate campaign that used malicious ChatGPT Custom GPTs to direct victims to a fake URL serving the ClickFix lure.
- Forescout found the same malware delivered from 86.109.75[.]7, which also hosted a ROMULUS panel.
- A separate ClickFix-triggered chain runs a PowerShell script that delivers Legion Loader.
Remediation
- Hunt for suspicious PowerShell commands and DLL sideloading events.
- Train users to recognize ClickFix lures that ask them to paste and run commands.
Linha do tempo
-
ROMULUS ClickFix delivery platform used to distribute Legion Loader and trojanized MSI payloads
ler a análise desta fonte ocultar
Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). Forescout identified six IP addresses running ROMULUS, and the operator is unknown. The platform may be a privately run panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. Forescout reports no overlap with RomulusLoader, a malware family tied to Silver Fox (TA4922). The findings show ClickFix evolving from a social engineering technique into an effective malware entry point.
Technical Details
- ROMULUS exposes two endpoints that download a PowerShell staging script, which decides the next payload: a trojanized MSI installer carrying a malware loader, or an encrypted archive containing Legion Loader.
- Legion Loader contacts a remote server to fetch and run additional payloads.
- 96.62.224[.]81 hosted a ClickFix script and an MSI installer in a separate campaign that used malicious ChatGPT Custom GPTs to direct victims to a fake URL serving the ClickFix lure.
- Forescout found the same malware delivered from 86.109.75[.]7, which also hosted a ROMULUS panel.
- A separate ClickFix-triggered chain runs a PowerShell script that delivers Legion Loader.
Remediation
- Hunt for suspicious PowerShell commands and DLL sideloading events.
- Train users to recognize ClickFix lures that ask them to paste and run commands.