Siemens has recently issued a crucial warning to its customers regarding the ongoing exploitation of a specific vulnerability within its Software Center. This vulnerability is categorized as a dynamic link library (DLL) side-loading issue, which cybercriminals are actively leveraging to distribute malware. The company has traced the source of this malicious activity to the Romulus multi-platform ClickFix campaign.
This alert follows the identification of Romulus, a server hosting panel recognized by researchers at Forescout on October 14. The Romulus infrastructure enables cybercriminals to implement ClickFix tactics across an extensive ecosystem, allowing them to continually deliver various forms of malware to unsuspecting victims. ClickFix itself is a well-known attack strategy that employs social engineering methods, enticing users to unwittingly execute harmful commands on their devices.
In a blog post released on October 19, Siemens elaborated on the targeting of a specific vulnerability, identified as CVE-2026-110936, which has a high Common Vulnerability Scoring System (CVSS) rating of 8.4. This vulnerability permits attackers to load harmful DLL files into directories scanned by the Siemens Software Center for legitimate applications. Cybercriminals employ a valid, signed version of the application and place their malicious files alongside it, camouflaging their attacks.
Once malicious files are introduced, attackers employ ClickFix lures to propagate these files among customers. A critical security issue highlighted by Siemens pertains to version 3.5.8.7 of the Software Center, which indiscriminately loaded helper files from its own directory without conducting any verification procedures. If a user inadvertently follows the ClickFix commands, the malicious code would execute on the device with the application’s inherent privileges.
Siemens has provided a stark warning to users: “Never paste a command from a web page into Win+R, the Run box, or PowerShell. A real ‘I am not a robot’ check never asks for this.” This advice underscores the importance of vigilance and caution among users navigating online spaces, particularly when dealing with commands copied from the web.
To counteract the threats posed by the Romulus campaign, Siemens has recommended that users of the Software Center upgrade to version 4.0.9.8, which contains a patch addressing this significant vulnerability. Fortunately, existing installations will automatically update the next time they are launched, streamlining the process of securing their systems.
Users are advised to be vigilant for several signs indicating possible compromise due to this campaign. These include unexpected entries in the start-up applications or Task Scheduler that reference “Siemens Software Center” on PCs that do not recall having the application installed. Additionally, the creation of a folder labeled SM Software Provisioning Service within the AppData\Local\Programs directory may indicate malicious activity. Users should also be wary of files named activate.bak or statinfosta.DB appearing next to SiemensSoftwareCenter.exe, and the presence of a folder called FTSuite containing a file named ftc.uml inside AppData\Local. Lastly, any network connections directed to the address 96.62.218[.]59 warrant immediate investigation.
In the event that a PC is found to be compromised, Siemens instructs customers to isolate the device promptly. The first steps should include halting any troublesome processes, removing pertinent start-up entries and tasks, and resetting passwords to bolster security.
The company underscores that detection tools should concentrate on examining folders and monitoring suspicious behavior rather than relying on the Siemens file fingerprint, as the actual file appears genuine. Users should prioritize downloading Siemens software exclusively from official channels and take proactive measures to block any active IP addresses and domains noted in the advisory.
In conclusion, as cyber threats evolve, the alert from Siemens serves as a critical reminder for all users to practice caution and stay informed about potential vulnerabilities. By updating software, recognizing warning signs, and adhering to best security practices, customers can better protect themselves against malicious cyber activity.