Three ClickFix stories landed within a week, and they describe one attack from three sides. Siemens confirmed that attackers exploit a flaw in Siemens Software Center, and CISA listed it on 20 October 2026. Forescout described ROMULUS, a ClickFix delivery platform that shares its name and one IP address with the campaign Siemens names. Google then added a ClickFix warning to Chrome. This post joins the three and ends with a list of controls.
What Happened This Week?
Siemens published advisory SSA-580366 on 15 October and fixed the flaw in Software Center 4.0.9.8. On 19 October it added a ProductCERT post that confirms active exploitation of CVE-2026-110936. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 20 October with a due date of 3 November.
Forescout’s Vedere Labs published its analysis of ROMULUS on 15 October. Google’s Chrome team wrote about the new copied-command warning on 20 October. Each source describes a different piece of the same pattern.
How Does the Siemens Flaw Fit ClickFix?
Siemens says the attackers took a genuine, validly signed copy of Software Center and placed their own files next to it. The version at the time, 3.5.8.7, loaded helper files from its own folder without checking them, so the attackers’ DLLs ran inside a trusted program. This is DLL side-loading. The Siemens program was not changed, and Siemens says none of its systems or update channels was breached to its knowledge.
The advisory scores the bug as local with high privileges required: 6.7 on CVSS v3.1 and 8.4 on v4.0. Siemens ties the exploitation to a ClickFix campaign, where the user runs the first command. Siemens names the activity the Romulus multi-platform ClickFix campaign.
What Is ROMULUS?
Forescout found ROMULUS while investigating an incident. It calls it a reusable delivery backend, not a single hard-coded malware server, with a login panel and six server addresses. One backend serves two routes. Route A installs a trojanized Stardock installer that side-loads a DLL, the same chain Huntress reported. Route B unpacks nested archives into LegionLoader, hidden in an executable of 882,716,672 bytes that is mostly padding. The ROMULUS profile has the details.
Forescout says the operator is unknown. One address, 2.27.248.127, is in Forescout’s list of ROMULUS servers and also in the indicators Siemens published. Neither source says more about the link than that overlap and the shared name.
What Does Chrome’s New Warning Cover?
Google says Chrome now detects when an Enhanced Protection user copies a suspicious command. Chrome removes personal information from the clipboard contents and sends them to Safe Browsing. If the verdict is dangerous, Chrome shows a warning. Google explains why this gap matters: the pasted command usually starts PowerShell or cmd.exe, so the malware is fetched in a terminal, and Chrome’s download checks never see it.
The limits are clear in Google’s text. The feature is described only for users who turned on Enhanced Protection. The post gives no rollout date and no list of supported systems. Treat it as one extra layer, not as the control.
- Fake error or CAPTCHAThe page tells the user to press Win+R and paste a commandTechnique T1204.004 (MITRE ATT&CK, opens in a new tab)
- PowerShell stagerThe command fetches an obfuscated script from a ROMULUS serverTechnique T1059.001 (MITRE ATT&CK, opens in a new tab)
- Silent MSI installmsiexec installs a bundle that includes a signed programTechnique T1218.007 (MITRE ATT&CK, opens in a new tab)
- DLL side-loadingThe signed program loads the attackers’ DLLTechnique T1574.001 (MITRE ATT&CK, opens in a new tab)
- PayloadForescout names LegionLoader on route B; Siemens does not name its payload
The chain above merges what Forescout and Siemens each describe. Siemens lists the signs on a PC but not every step, so read it as the common shape, not as one confirmed sequence. The steps map to MITRE T1204.004 Malicious Copy and Paste, which also appears in our ENISA phishing trends analysis.
What Do Dark Web and Telegram Sources Show?
We searched dark web and Telegram sources from 21 September to 21 October 2026. ClickFix appears in 213 posts, 169 of them on Telegram, 35 on forums and 9 on Discord. Of 21 posts that mention ROMULUS, 17 also mention ClickFix, and 16 of those 17 are dated 16 to 21 October, after Forescout’s report. Eleven of the 21 name Forescout. The 9 posts on CVE-2026-110936 first appear on 15 October, and 6 of them are dated 20 or 21 October.
Read this as attention, not as proof of use. The counts show that the report spread quickly in these channels. They do not show who runs ROMULUS or how many victims it has.
What Should Defenders Do Now?
- Update Siemens Software CenterVersion 4.0.9.8 or later. Installed copies update at the next start.
- Block the Siemens indicators96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127, then search logs for them.
- Hunt by behaviourSiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.
- Hunt PowerShell pastesPowerShell with a URL plus -NoProfile, -ep bypass or -w hidden, and decimal IP addresses in command lines.
- Keep script and command-line logs onThe two searches above only work if the logs exist.
- Limit what pasted code can doMITRE suggests application control and PowerShell Constrained Language mode.
- Tell users one ruleNever paste a command from a web page into Win+R, Run or PowerShell.
The first two items close the Siemens case. The hunting items catch the wider family, since Forescout says ROMULUS also delivers a Stardock chain that matches what Huntress reported earlier. If you find a Siemens sign, follow Siemens: isolate the PC, stop the process first, then remove the start-up entry and the task, and reset passwords. Detect on folder and behaviour, not on the Siemens file hash, because the file itself is genuine.
The Chrome setting is worth turning on for staff who handle sensitive data. Pair it with training, since command and scripting interpreter abuse starts with a person who believes the page. Teams that want to see ClickFix lures and stolen-data mentions earlier can use Cyber Threat Intelligence monitoring.