ROMULUS Platform Leverages ClickFix Tactics to Distribute LegionLoader Malware
New malware delivery infrastructure uses deceptive landing pages to execute malicious PowerShell scripts.
1Emergence of ROMULUS Platform
Cybersecurity researchers at Forescout Research Vedere Labs identified a new delivery platform named ROMULUS. This infrastructure utilizes ClickFix-style lures on deceptive landing pages to trick users into executing malicious commands. The platform functions as a malware delivery service, potentially operating as a commercial framework or a private tool shared among various cybercriminal operators.
2Operational Mechanics and Infrastructure
The platform exposes two specific endpoints designed to trigger PowerShell staging scripts. These scripts determine the subsequent payload, which can be a trojanized MSI installer or an encrypted archive. Researchers identified six distinct IP addresses running the ROMULUS panel, including server 96.62.224.81, which was previously linked to malicious ChatGPT Custom GPT campaigns.
3LegionLoader Payload Delivery Strategy
ROMULUS facilitates the distribution of LegionLoader, also known as Satacom, CurlyGate, or RobotDropper. To evade detection, attackers inflate the malicious archive to nearly 1 GB using repetitive padding. This technique effectively bypasses sandbox analysis budgets, static-analysis thresholds, and common upload size limits, allowing the loader to reach the target machine successfully.
4Distinction from RomulusLoader
Despite the naming similarity, the ROMULUS platform shows no technical overlap with the previously documented RomulusLoader. RomulusLoader is associated with the China-aligned threat actor Silver Fox, also known as TA4922. Silver Fox typically employs tax-related pretexts to distribute remote access trojans like ValleyRAT, DcRAT, and Venom RAT via DLL sideloading techniques.
5Evolution of ClickFix Tactics
The ROMULUS campaign highlights the evolution of ClickFix from a simple social engineering technique into a sophisticated entry point for malware. By forcing users to interact with fake error messages, attackers gain unauthorized command execution. This shift demonstrates how threat actors are refining their delivery mechanisms to increase the success rate of initial infections.
6Mitigation and Security Hunting
To defend against these threats, security teams must prioritize hunting for suspicious PowerShell commands and unauthorized DLL sideloading events. Organizations should monitor their network traffic for connections to known malicious endpoints identified in the ROMULUS infrastructure. Proactive detection of these staging scripts is essential to preventing the final payload from executing on endpoints.
7AI-Driven Threat Vectors
The integration of malicious ChatGPT Custom GPTs into the ROMULUS delivery chain marks a significant shift in threat actor methodology. These AI agents are increasingly used to direct victims to fake URLs, serving as a gateway for ClickFix lures. Securing these AI interfaces is now critical to preventing unauthorized access to sensitive systems.
8Strategic Security Preparedness
As malware delivery platforms become more automated and evasive, organizations must strengthen their attack surface visibility. Assessing AI threat readiness and controlling permissions for AI agents are vital steps in reducing insider risk. Security operations centers should focus on emerging threats to ensure they can effectively mitigate sophisticated delivery chains like ROMULUS.