Siemens has warned customers that attackers are actively exploiting a dynamic link library (DLL) side-loading vulnerability in its Software Center to distribute malware.
The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
Romulus is a server hosting panel that was identified by Forescout researchers on October 14. The panel allows cybercriminals to deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims.
ClickFix is a popular attack technique among cybercriminals. It relies on social engineering to trick the victim into running attacker-supplied commands on their own machine.
The Siemens blog, published on October 19, detailed how attackers are targeting CVE-2026-110936 (CVSS 8.4) to load malicious DLL files into a directory that the Siemens Software Center searches for. They use a genuine copy of the application with a valid signature and place their own files next to it.
The attackers then attempt to distribute these files to customers by using a ClickFix lure.
Version 3.5.8.7 of Software Center loaded helper files from its own folder without checking them, the firm admitted.
If a user follows the ClickFix commands, malicious code will execute on the device with the privileges of the affected application.
“Never paste a command from a web page into Win+R, the Run box or PowerShell. A real ‘I am not a robot’ check never asks for this,” Siemens wrote.
How to Defend Against the Romulus Campaign
Siemens urged Software Center customers update to version 4.0.9.8, which contains a fix for the flaw. Existing installations update automatically the next time they start.
Customers should also look out for the following indications that their PC is affected by the campaign:
- "Siemens Software Center" in the start-up apps or Task Scheduler of a PC that never had it installed
- A folder called SM Software Provisioning Service inside AppData\Local\Programs is created by the malware
- Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe
- A folder called FTSuite containing a file ftc.uml inside AppData\Local
- Network connections to 96.62.218[.]59
If a PC has been found to be compromised, customers should isolate the device, stop the process first, then remove the start-up entry and task and reset passwords.
Siemens added that detection tools should focus on the folder and suspicious behavior, not on the Siemens file fingerprint as the file itself is genuine.
Customers should also ensure that they only download Siemens software from official Siemens sources and block the active IP address and domain listed in the advisory.
Image credit: Kittyfly / Shutterstock.com