Quick links
Press Enter to search, Esc to close
Malware profile
ROMULUS is a ClickFix delivery platform that Forescout's Vedere Labs described on 15 October 2026.
In short
ROMULUS is a ClickFix delivery platform that Forescout's Vedere Labs described on 15 October 2026. One backend serves several payloads, including LegionLoader and a DLL side-loading chain that Huntress had reported. Siemens names a Romulus ClickFix campaign in its warning about CVE-2026-110936.
Forescout found ROMULUS while investigating an incident. It has a dark-themed login panel, and six server addresses ran it. Forescout calls it a reusable delivery backend rather than a single hard-coded malware server, in active use at scale. One server exposes a statistics page with unique installs, all runs, a 14-day timeline and a country breakdown.
Forescout says the operator is unknown. ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework or software copied between operators. Siemens uses the name for the campaign behind the exploitation of CVE-2026-110936, and one address, 2.27.248.127, appears in both Siemens’ and Forescout’s lists.
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| ROMULUS | Name Forescout gives the delivery platform[1] |
| Romulus multi-platform ClickFix campaign | Wording Siemens uses for the attackers behind the exploitation of CVE-2026-110936[2] |
| LegionLoader (CurlyGate, RobotDropper, Satacom) | Final payload of route B, with the aliases Forescout lists[1] |
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Obfuscated Files or Information: Command Obfuscation T1027.010
The staging script rebuilds its code from integer arrays and deletes itself.[1]
Obfuscated Files or Information: Binary Padding T1027.001
Route B ends in an executable of 882,716,672 bytes, mostly repetitive padding.[1]
Obfuscated Files or Information: Encrypted/Encoded File T1027.013
Password-protected archives and AES-256 encrypted stages hide the payload.[1]
Deobfuscate/Decode Files or Information T1140
Each stage decrypts the next one, ending in a manually mapped LegionLoader PE.[1]
System Binary Proxy Execution: Msiexec T1218.007
Route A installs the MSI silently with msiexec.[1]
Hijack Execution Flow: DLL T1574.001
Route A launches a signed Stardock program that loads a patched DLL. Forescout lists the old id T1574.002, which MITRE now folds into T1574.001.[1]
Forescout describes the entry as a ClickFix lure that makes the victim run PowerShell, which fetches a staging script from the ROMULUS server. Siemens says that in the related campaign the attackers distributed a genuine signed Siemens program together with their own DLL files, outside official Siemens channels.
The order of steps in a typical infection, as the sources describe it.
The victim is tricked into running PowerShell, which fetches a staging script from a ROMULUS /s/ route with a 12-character hexadecimal token.[1]
A heavily obfuscated script rebuilds its code from integer arrays, runs it with [scriptblock]::Create and deletes itself, then takes route A or B.[1]
It downloads IconEdit2Turb.msi and installs it silently. The trojanized Stardock tool then launches DeElevate64.exe, a patched DeElevator64.dll and the loader I++u.dll.[1, 3]
It downloads J8QkZUVJgV.7z and 7zr.exe, then opens two password-protected archives to get five .bin files and one padded executable.[1]
Stage 1 decrypts stage 2 with AES-256. The shellcode then maps the LegionLoader PE into memory.[1]
LegionLoader registers and takes commands on /nfront.php and sends results to /nback.php, with RC4 encryption and Base64 in one form-urlencoded blob.[1]
Forescout dates the trojanized Stardock Smart DeElevation Tool MSI to 25 September 2026.[1]
Huntress publishes a ClickFix campaign write-up in which MSI installers abuse signed Canon and Stardock programs for DLL side-loading. An update on 14 October lists new domains.[3]
Forescout Research, Vedere Labs, describes the platform, its six servers and both routes.[1]
Siemens confirms active exploitation of CVE-2026-110936 and names the Romulus multi-platform ClickFix campaign.[2]
CISA adds CVE-2026-110936 to the Known Exploited Vulnerabilities catalog.[6]
Google says Chrome now detects when an Enhanced Protection user copies a suspicious command.[5]
A multi-payload ClickFix delivery platform that Forescout's Vedere Labs found while investigating an incident. Six server addresses ran it, and the operator is unknown.
Forescout calls it a reusable delivery backend. It says it may be a private panel, a commercial delivery service, an affiliate framework or software copied between operators.
Forescout describes two routes: a trojanized Stardock installer with a DLL side-loading chain that matches what Huntress reported, and a nested archive chain that ends in LegionLoader.
Siemens names the Romulus multi-platform ClickFix campaign in its warning about CVE-2026-110936. The address 2.27.248.127 appears in Siemens' list and in Forescout's list of ROMULUS servers.
Update Siemens Software Center to 4.0.9.8 or later, then run the paste-stage hunts from the T1204.004 page and the ROMULUS hunts for 7-Zip use and oversized files.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
