/
← Voltar ao feed
high

Siemens Software Center DLL flaw CVE-2026-110936 exploited in Romulus ClickFix malware campaign

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 15:15 · coletado há 1 dia

Siemens disclosed on Monday that threat actors exploited CVE-2026-110936, a DLL search-path vulnerability in Siemens Software Center, in a malware campaign. The attackers bundled a legitimately signed copy of the Siemens program with their own malicious DLLs, which the program loaded from its own folder at startup. Siemens links the activity to Romulus, a multi-platform ClickFix delivery platform recently documented by Forescout. Siemens states that none of its systems, products or update channels were breached and that the malicious package was not distributed through its channels.

Technical Details

  • The flaw stems from the program not properly restricting the locations searched for DLL files. An authenticated local attacker can plant a malicious DLL and execute code with the privileges of Software Center. Siemens rated it CVSS v4 8.4.
  • Version 3.5.8.7, the newest release at the time, did not validate the helper DLLs before loading them.
  • ClickFix attacks use fake prompts, such as bogus CAPTCHA checks, to trick users into pasting and running malicious commands.
  • Forescout found Romulus running on several servers, including the one Siemens identified as the distribution server for the malicious bundle. Romulus delivered LegionLoader and a trojanized installer that used a legitimate Stardock application for DLL side-loading. Forescout could not determine who runs Romulus.
  • Huntress described the same Stardock-based package in a late-September campaign that used rogue ChatGPT Custom GPTs to lure users to ClickFix pages. Signed Canon and later Stardock programs were abused to side-load code that ultimately deployed a RAT. Huntress responded to at least 40 incidents and believes signed programs from other vendors are probably being misused as well.
  • Siemens Software Center is not mentioned in the Huntress or Forescout reports. The overlapping infrastructure and similar side-loading approach suggest it was added to the same toolkit.
  • Siemens' blog post lists IoCs and signs of infection. Because the Siemens file is legitimate, Siemens advises focusing on suspicious behavior and malware-associated folders rather than file hashes.

Remediation

  • Update to Software Center 4.0.9.8. Existing installations receive the fix automatically on next launch.
  • Use the IoCs and infection indicators in the Siemens blog post for hunting.
  • Prioritize behavioral detection of signed binaries side-loading DLLs from unusual folders over hash-based detection.

Linha do tempo

  1. securityweek.com ↗ · pub. 19/10/2026 15:15 · coletado 19/10 17:53 primeiro registro

    Siemens Software Center DLL flaw CVE-2026-110936 exploited in Romulus ClickFix malware campaign

    ler a análise desta fonte

    Siemens disclosed on Monday that threat actors exploited CVE-2026-110936, a DLL search-path vulnerability in Siemens Software Center, in a malware campaign. The attackers bundled a legitimately signed copy of the Siemens program with their own malicious DLLs, which the program loaded from its own folder at startup. Siemens links the activity to Romulus, a multi-platform ClickFix delivery platform recently documented by Forescout. Siemens states that none of its systems, products or update channels were breached and that the malicious package was not distributed through its channels.

    Technical Details

    • The flaw stems from the program not properly restricting the locations searched for DLL files. An authenticated local attacker can plant a malicious DLL and execute code with the privileges of Software Center. Siemens rated it CVSS v4 8.4.
    • Version 3.5.8.7, the newest release at the time, did not validate the helper DLLs before loading them.
    • ClickFix attacks use fake prompts, such as bogus CAPTCHA checks, to trick users into pasting and running malicious commands.
    • Forescout found Romulus running on several servers, including the one Siemens identified as the distribution server for the malicious bundle. Romulus delivered LegionLoader and a trojanized installer that used a legitimate Stardock application for DLL side-loading. Forescout could not determine who runs Romulus.
    • Huntress described the same Stardock-based package in a late-September campaign that used rogue ChatGPT Custom GPTs to lure users to ClickFix pages. Signed Canon and later Stardock programs were abused to side-load code that ultimately deployed a RAT. Huntress responded to at least 40 incidents and believes signed programs from other vendors are probably being misused as well.
    • Siemens Software Center is not mentioned in the Huntress or Forescout reports. The overlapping infrastructure and similar side-loading approach suggest it was added to the same toolkit.
    • Siemens' blog post lists IoCs and signs of infection. Because the Siemens file is legitimate, Siemens advises focusing on suspicious behavior and malware-associated folders rather than file hashes.

    Remediation

    • Update to Software Center 4.0.9.8. Existing installations receive the fix automatically on next launch.
    • Use the IoCs and infection indicators in the Siemens blog post for hunting.
    • Prioritize behavioral detection of signed binaries side-loading DLLs from unusual folders over hash-based detection.