Siemens Software Center Vulnerability Exploited in ClickFix Malware Campaigns
Attackers leverage DLL sideloading in Siemens software to deploy remote access trojans.
1Critical DLL Sideloading Flaw
Siemens identified a high-severity vulnerability, CVE-2026-110936, within its Software Center application. With a CVSS v4 score of 8.4, the flaw stems from an uncontrolled DLL search path. This allows authenticated local attackers to place malicious files in directories, enabling arbitrary code execution with the same privileges as the affected service.
2Exploitation via Trusted Signatures
Attackers abused a genuine, digitally signed copy of Siemens Software Center to bypass security scrutiny. By placing a crafted archive.dll file alongside the legitimate executable, threat actors triggered malicious code execution. Version 3.5.8.7 was specifically targeted because it loaded helper files from its own folder without verifying their integrity.
3Romulus and ClickFix Delivery
The activity is attributed to the Romulus platform, a known ClickFix delivery mechanism. Forescout researchers linked this platform to the deployment of Legion Loader and other malware. Attackers utilize msiexec.exe to launch AllMyBasic.msi, which subsequently initiates the SiemensSoftwareCenter.exe process to complete the malicious sideloading sequence on the target system.
4Social Engineering and Lures
Campaigns have utilized malicious ChatGPT Custom GPTs to redirect victims toward fake URLs. These sites serve ClickFix lures that prompt users to copy and execute PowerShell commands. This process drops an MSI installer, which initiates the DLL sideloading chain to ultimately deploy a remote access trojan on the victim's machine.
5Patching and Remediation Steps
Siemens has officially addressed the vulnerability in version 4.0.9.8 of the Software Center. Organizations must update their applications immediately to mitigate the risk. Simply updating the software and restarting the application is necessary to apply the security fix and prevent further exploitation of the previously vulnerable DLL loading mechanism.
6Indicators of Compromise Detection
Security teams should monitor for specific indicators of compromise associated with this campaign. Specifically, look for instances where SiemensSoftwareCenter.exe is running from the AppData\Local\Programs directory and was initiated by msiexec.exe. Blocking associated IP addresses and domains is recommended to disrupt the communication channels used by the Romulus platform.
7Researcher Discovery and Attribution
The vulnerability was discovered and reported by Jose Oregon, a researcher at Huntress Labs. His findings highlighted how threat actors weaponize trusted software to maintain persistence and execute payloads. This discovery emphasizes the ongoing risk posed by legitimate applications that fail to validate the integrity of their own helper files.
8Broader Security Implications
This incident underscores the danger of DLL sideloading in enterprise environments. By exploiting trusted, signed software, attackers effectively bypass traditional signature-based detection methods. Organizations must maintain strict visibility over application execution paths and ensure that software update cycles are prioritized to close these critical gaps before they are actively weaponized.