Attackers Brought Their Own Copy of Siemens Software Center. Patching Yours Is Not the Whole Fix.
Siemens confirmed on October 19 that a flaw in Siemens Software Center, CVE-2026-110936, is being used in ClickFix attacks. The attackers do not need you to have Siemens software installed. They ship a genuine, validly signed copy of an old version next to their own malicious DLL, and the signed program loads it. So updating your own copy is worth doing, but it does not stop this campaign. What stops it is a user who will not paste a command from a web page, and a defender who looks for the signed Siemens program running where it should not be. We hold all five indicators Siemens published. None of the early records are ours: one Siemens IP sat in a community feed a week before Siemens published, and that credit goes to the person who submitted it.
What the bug is
Siemens Software Center downloads, installs, activates and updates Siemens software. Siemens advisory SSA-580366, published October 15, says that every version before 4.0.9.8 loads DLLs from an uncontrolled search path (CWE-427). An attacker who can put a crafted DLL in a folder the program searches gets code running with the program's privileges. It scores 6.7 under CVSS v3.1 and 8.4 under CVSS v4.0. Jose Oregon of Huntress reported it.
Siemens' October 19 notice explains how it is being used. Version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them. The attackers took a genuine signed copy, placed their own files next to it, and let it load them. Siemens says the program itself was not modified, and that, to its knowledge, no Siemens system, product or update channel was breached. The malicious bundle was distributed outside official channels.
That is the important part. A signed binary is a trusted binary to many tools. The attacker is borrowing Siemens' signature, not attacking Siemens customers in particular.
How ClickFix gets a user to run it
ClickFix is a fake check on a web page, usually an "I am not a robot" box, that tells the user to press Win+R, paste a command and press Enter. The command is the attack. Siemens' advice is blunt: a real robot check never asks you to do this.
In this campaign the command leads to an MSI installer, AllMyBasic.msi. Siemens says to look for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec. The malicious DLL is archive.dll.
Siemens attributes the activity to ROMULUS, which Forescout's Vedere Labs described on October 15. Forescout calls it a multi-payload ClickFix delivery platform: a panel that hands out different payloads by token, seen on at least six IP addresses. They could not tell who runs it, or whether it is private, rented or copied. One route installs a trojanized Stardock tool that sideloads a loader, the same chain Huntress reported on September 28 behind fake ChatGPT Custom GPTs. Another route downloads nested password-protected archives that unpack to a padded executable of more than 800 MB, which decrypts shellcode and then LegionLoader. LegionLoader talks to smashshape[.]com, takes PowerShell commands and download instructions, and handles Chrome's Local State keys, which protect saved browser data.
Two things the sources do not say. Neither Siemens nor Forescout names the sectors or countries being targeted. And Siemens does not name the final payload in the Siemens-carrier chain. It names ROMULUS, and ROMULUS has delivered more than one thing. The link between the two reports is infrastructure: 2.27.248[.]127, which Siemens lists as the server that distributed AllMyBasic.msi, is one of the ROMULUS hosts in Forescout's table.
Signs a PC is affected
From Siemens' notice:
"Siemens Software Center" in the startup apps or Task Scheduler of a PC that never had it installed.
A folder named SM Software Provisioning Service inside AppData\Local\Programs.
Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
A folder named FTSuite containing ftc.uml inside AppData\Local.
Network connections to 96.62.218[.]59.
Siemens' indicators: 96.62.218[.]59 and wizardexpensive[.]com, both active payload hosting and C2 when published; 2.27.248[.]127, the inactive distribution server; and SHA-256 hashes for AllMyBasic.msi (f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a) and archive.dll (3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491). Siemens says to detect on folder and behavior, not on the hash of the Siemens program, because that file is genuine.
What our feed held, and who held it first
All five Siemens indicators are in our index from a batch we ingested on October 19, after Siemens published. The IP and domain are at confidence 85, the two hashes at 90. The distribution server 2.27.248[.]127 is at 70, because Siemens lists it as inactive.
Before that, community feeds already had pieces of this:
96.62.218[.]59, Siemens' active C2, entered our index from TweetFeed on October 12, seven days before the Siemens notice, at confidence 70.
86.109.75[.]7, the ROMULUS server Forescout analyzed, entered from URLhaus on September 29 as download URLs, including the IconEdit2Turb.msi path in Forescout's report. A ThreatFox submitter tagged one of its URLs ClearFake on October 3.
orbitflownetwork[.]lol (the archive host) and smashshape[.]com (the LegionLoader C2) entered from ThreatFox on October 3, at 70.
23.94.145[.]224 entered from TweetFeed on October 1, and 151.240.151[.]223 from URLhaus on October 12. Forescout lists both as ROMULUS hosts it did not analyze.
96.62.224[.]81 and five of Forescout's hashes were in our index from October 2, at 85. That was our import of Huntress's September 28 report, so it is Huntress's work.
Ingest time is not detection time. Each of those dates is when a record entered our index, and every early record came from somebody else's research or submission. Our own first-party lead here is zero. What the records show is that the community had this infrastructure one to two weeks before the vendors wrote it up.
Against Forescout's full list (6 IPs, 3 domains, 13 hashes), we held 12 of 22 this morning. Eleven were in the index before Forescout published, all from the third-party lanes above. Today we added the 9 we lacked, each read back after the write: the IP 93.152.224[.]118 and the earlier stager domain novatrafficcore[.]lol at 80 (Forescout itself marks that domain's link to ROMULUS unconfirmed), and seven hashes at 85, covering both staging scripts, both archives and the three LegionLoader stages. That makes 21 of 22. The one we left out is the legitimate signed Stardock DeElevate64.exe, which should never be on a blocklist.
What our own edge would have blocked
Holding a record and blocking on it are different things. Our own edge blocks IPs at confidence 80 and up. Of the seven campaign IPs across both reports, four are in ips.csv at min_confidence=80 today: 96.62.218[.]59 at 85 since October 19, 96.62.224[.]81 at 85 since October 2, 86.109.75[.]7 at 80 since this morning, when our convergence job promoted it from the URLhaus and ThreatFox records, and 93.152.224[.]118 at 80 from today's Forescout ingest. Every one of the four crossed the line after Huntress, Forescout or Siemens published.
The early community records sat at 70. The TweetFeed record for 96.62.218[.]59 was in our index a week early and below our edge's floor. The URLhaus records for 86.109.75[.]7 were URLs, which the IP list does not serve, so the bare IP took three weeks and two vendor reports to reach 80. We have written about that gap this week, and it is still the gap.
One more honest measurement. The two ThreatFox domains are not in today's domains.csv at all. The file carries third-party feed records for about a week, and the oldest ThreatFox row in it today is from October 13. Those domains arrived October 3, so a subscriber who started pulling the file this week does not get them. A named-campaign domain should not age out because a week passed. That is ours to fix.
What a small team should do this week
Tell people, in one sentence: never paste a command from a web page into Win+R, the Run box, PowerShell or Terminal. No real CAPTCHA asks for that.
If you can, turn off the Run dialog for users who do not need it, and alert on PowerShell started with hidden-window or execution-policy-bypass flags and a URL on the command line.
Look for SiemensSoftwareCenter.exe anywhere outside its normal install folder, especially under AppData\Local\Programs, and for it in startup apps on PCs that never had Siemens software.
Check the folders and files in the list above. If you find them, isolate the PC, stop the process, remove the startup entry and scheduled task, and reset the user's passwords. A stealer-class loader means browser-saved credentials should be treated as gone.
Update Siemens Software Center to 4.0.9.8 or later if you run it. It updates itself the next time it starts.
Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127, and search your logs for all three, including the inactive one.
Expect this to happen with other vendors' signed programs. Huntress saw Canon and Stardock binaries used the same way. A signed file in a strange folder is the signal, not the signature.
Where this leaves us
The community feeds were early on this campaign and we were not. That is fine. Our job is to carry their records to the people who cannot afford to watch every feed, and to do it at a confidence the customer can choose. The honest finding is that our own block line caught up only after the reports, and that two of the community's best early domains have already aged out of our domain file. Both of those are fixable, and both are on our list.
The free key that pulls the feed, at whatever confidence threshold fits your network, is at https://analytics.dugganusa.com/stix/register?utm_source=blog&utm_campaign=siemens-clickfix
Primary sources: Siemens ProductCERT notice (https://productcert.siemens.com/news), Siemens advisory SSA-580366 (https://productcert.siemens.com/productcert/html/ssa-580366.html), Forescout's ROMULUS report (https://www.forescout.com/blog/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform/), and Huntress's Custom GPT ClickFix report (https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat).
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=attackers-brought-their-own-copy-of-siemens-software-center-patching-yours-is-not-the-whole-fix
Comments