One backend serves several payloads, including LegionLoader and a DLL side-loading chain that Huntress had reported. Siemens names a Romulus ClickFix campaign in its warning about CVE-2026-110936.
What it does
Forescout found ROMULUS while investigating an incident. It has a dark-themed login panel, and six server addresses ran it. Forescout calls it a reusable delivery backend rather than a single hard-coded malware server, in active use at scale. One server exposes a statistics page with unique installs, all runs, a 14-day timeline and a country breakdown.
Forescout says the operator is unknown. ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework or software copied between operators. Siemens uses the name for the campaign behind the exploitation of CVE-2026-110936, and one address, 2.27.248.127, appears in both Siemens’ and Forescout’s lists.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| ROMULUS | Name Forescout gives the delivery platform[1] |
What it can do
The ATT&CK techniques the cited sources map to this tool, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Execution
Command and Control
Stealth
Obfuscated Files or Information: Command Obfuscation T1027.010
The staging script rebuilds its code from integer arrays and deletes itself.[1]
Obfuscated Files or Information: Binary Padding T1027.001
Route B ends in an executable of 882,716,672 bytes, mostly repetitive padding.[1]
Obfuscated Files or Information: Encrypted/Encoded File T1027.013
Password-protected archives and AES-256 encrypted stages hide the payload.[1]
Deobfuscate/Decode Files or Information T1140
Each stage decrypts the next one, ending in a manually mapped LegionLoader PE.[1]
System Binary Proxy Execution: Msiexec T1218.007
Route A installs the MSI silently with msiexec.[1]
Hijack Execution Flow: DLL T1574.001
Route A launches a signed Stardock program that loads a patched DLL. Forescout lists the old id T1574.002, which MITRE now folds into T1574.001.[1]
How it spreads
Forescout describes the entry as a ClickFix lure that makes the victim run PowerShell, which fetches a staging script from the ROMULUS server. Siemens says that in the related campaign the attackers distributed a genuine signed Siemens program together with their own DLL files, outside official Siemens channels. Elastic's November 2026 report counts ScreenConnect as the RMM tool named most often in its own confirmed abuse cases; see how fast that trust gets turned against defenders.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
ClickFix lure
The victim is tricked into running PowerShell, which fetches a staging script from a ROMULUS /s/ route with a 12-character hexadecimal token.[1]
Staging script
A heavily obfuscated script rebuilds its code from integer arrays, runs it with [scriptblock]::Create and deletes itself, then takes route A or B.[1]
Route A: side-loading
It downloads IconEdit2Turb.msi and installs it silently. The trojanized Stardock tool then launches DeElevate64.exe, a patched DeElevator64.dll and the loader I++u.dll.[1, 3]
Route B: archives
It downloads J8QkZUVJgV.7z and 7zr.exe, then opens two password-protected archives to get five .bin files and one padded executable.[1]
Decrypt and map
Stage 1 decrypts stage 2 with AES-256. The shellcode then maps the LegionLoader PE into memory.[1]
Command and control
LegionLoader registers and takes commands on /nfront.php and sends results to /nback.php, with RC4 encryption and Base64 in one form-urlencoded blob.[1]
Timeline
- 25 Sep 2026
Trojanized Stardock installer dated
Forescout dates the trojanized Stardock Smart DeElevation Tool MSI to 25 September 2026.[1]
- 28 Sep 2026
Huntress reports the Stardock and Canon chains
Huntress publishes a ClickFix campaign write-up in which MSI installers abuse signed Canon and Stardock programs for DLL side-loading. An update on 14 October lists new domains.[3]
- 15 Oct 2026
Forescout publishes ROMULUS analysis
Forescout Research, Vedere Labs, describes the platform, its six servers and both routes.[1]
- 19 Oct 2026
Siemens ties exploitation to Romulus
Siemens confirms active exploitation of CVE-2026-110936 and names the Romulus multi-platform ClickFix campaign.[2]
- 20 Oct 2026
CISA lists the Siemens flaw
CISA adds CVE-2026-110936 to the Known Exploited Vulnerabilities catalog.[6]
- 20 Oct 2026
Google adds a ClickFix warning to Chrome
Google says Chrome now detects when an Enhanced Protection user copies a suspicious command.[5]
Detection and defense
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Cyber Threat Intelligence
Brandefense Cyber Threat Intelligence tracks malware families and the infrastructure they use, and shares indicators your team can check against its own systems.
Frequently Asked Questions
What is ROMULUS?
A multi-payload ClickFix delivery platform that Forescout's Vedere Labs found while investigating an incident. Six server addresses ran it, and the operator is unknown.
Is ROMULUS malware or a service?
Forescout calls it a reusable delivery backend. It says it may be a private panel, a commercial delivery service, an affiliate framework or software copied between operators.
Which payloads does it deliver?
Forescout describes two routes: a trojanized Stardock installer with a DLL side-loading chain that matches what Huntress reported, and a nested archive chain that ends in LegionLoader.
How does it relate to the Siemens flaw?
Siemens names the Romulus multi-platform ClickFix campaign in its warning about CVE-2026-110936. The address 2.27.248.127 appears in Siemens' list and in Forescout's list of ROMULUS servers.
What should defenders do first?
Update Siemens Software Center to 4.0.9.8 or later, then run the paste-stage hunts from the T1204.004 page and the ROMULUS hunts for 7-Zip use and oversized files.
Sources
- ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery PlatformForescout Research, Vedere Labs · Supports: The platform, both routes, infrastructure, LegionLoader and the detection advice.
- Active Exploitation of CVE-2026-110936 in Siemens Software CenterSiemens ProductCERT · Supports: Exploitation, the Romulus campaign name, indicators and advice.
- Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixHuntress · Supports: The Canon and Stardock side-loading chains that Forescout links to route A.
- User Execution: Malicious Copy and Paste, T1204.004MITRE ATT&CK · Supports: The ClickFix technique definition.
- Our latest defenses against evolving web scamsGoogle Security Blog · Supports: Chrome warning for suspicious copied commands.
- Known Exploited Vulnerabilities CatalogCISA · Supports: CVE-2026-110936 added on 20 October 2026.
- SSA-580366: DLL Sideloading Vulnerability in Siemens Software CenterSiemens ProductCERT · Supports: Fixed version 4.0.9.8 and the flaw description.
