ISLAMABAD – It looks like a routine ‘prove you’re human’ check, until it asks you to run a command, and that simple step can trigger malware download, as hackers exploiting Siemens software flaw to slip malicious code onto your PC.
The campaign uses deceptive webpages to persuade victims to execute commands on their computers, before deploying a legitimate Siemens program alongside a malicious file. Once launched, the vulnerable App loads attacker-controlled code, potentially enabling persistent access and communication with criminal infrastructure.
According to the supplied findings, Siemens linked the exploitation to the ROMULUS multi-platform ClickFix campaign, an operation associated with the delivery of multiple malware payloads. Siemens says the attacks did not involve a breach of its systems, products or official update channels. The executable used by the attackers was authentic and unmodified, but distributed with malicious components outside the company’s official channels.
Verification Screen Trap
The infection starts with fraudulent webpage, often displaying CAPTCHA-style verification request. Visitors are instructed to copy a command and paste it into PowerShell, the Windows Run dialog or a similar interface. After those instructions downloads and runs AllMyBasic.msi, an installer that places the genuine SiemensSoftwareCenter.exe executable beside a malicious archive.dll and supporting files.
The vulnerable application then loads the DLL, allowing the malicious code to execute under the privileges of Software Center. Reported capabilities include establishing persistence, contacting command-and-control servers and supporting remote access. The method, known as DLL side-loading, exploits the trust attached to a legitimate application. A valid digital signature on the Siemens executable does not make the accompanying files safe.
The supplied advisory details identify the vulnerability as CVE-2026-110936, classified under CWE-427: Uncontrolled Search Path Element. It carries a CVSS v4.0 severity score of 8.4, rated High, and a CVSS v3.1 score of 6.7, rated Medium. Versions earlier than 4.0.9.8 are described as vulnerable. The observed attacks specifically used version 3.5.8.7, identified in the supplied reporting as the latest release at the time of the campaigns.
The weakness allows locally authenticated attacker, or an installer executed by a deceived user, to place crafted DLL in a directory searched by the application. When Software Center launches, it can load that file and execute its contents. Siemens Software Center is ordinarily used to download, install, activate and update Siemens software.
Forescout’s research described ROMULUS as a reusable ClickFix delivery platform capable of distributing different malware families. The reported overlap with the Siemens activity includes shared infrastructure, particularly the previously used distribution address 2.27.248[.]127. One ROMULUS delivery route identified by Forescout involved LegionLoader, also called CurlyGate, RobotDropper or Satacom, with Chrome browser data theft capabilities.
That finding concerns particular ROMULUS route; it does not establish that every Siemens-related infection delivered LegionLoader or stole browser data. Related Huntress reporting from late September described ClickFix campaigns using fake ChatGPT Custom GPTs to lure victims into similar attacks. Those operations involved signed Canon and Stardock applications, with reported similarities in infrastructure and DLL side-loading techniques. Siemens credited Huntress Labs researcher Jose Oregon in its advisory, SSA-580366.
Siemens Software Center 4.0.9.8 addresses the vulnerability. According to the supplied guidance, existing installations automatically update when next launched. Downloads should come exclusively from official Siemens sources.
An unfamiliar Siemens Software Center entry in startup applications or Task Scheduler warrants investigation, especially if the computer’s owner never installed the utility. Other reported warning signs include the application running from an AppData directory, being launched by msiexec, or appearing alongside unusual DLLs outside its normal installation location.
The supplied findings also list these file hashes:
| File | SHA-256 |
|---|---|
| AllMyBasic.msi | f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a |
| archive.dll | 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491 |
Reported network indicators
| Indicator | Status at the time of reporting |
|---|---|
| 96.62.218[.]59 | Active infrastructure associated with payload delivery or command and control |
| wizardexpensive[.]com | Active domain associated with payload delivery or command and control |
| 2.27.248[.]127 | Previous distribution infrastructure, reported inactive |
The immediate recommendation is to update to version 4.0.9.8 or later and refuse webpage instructions asking users to paste commands into PowerShell or the Windows Run dialog. Legitimate CAPTCHA checks do not require system commands. For security teams, the supplied Siemens guidance prioritises suspicious folders, accompanying DLLs and execution behaviour over the hash of the genuine Siemens executable.
Broader precautions include ClickFix awareness training, application controls, appropriate PowerShell logging and constrained language settings where suitable, alongside endpoint monitoring for signed applications loading suspicious files.
Pakistani News Channel’s Website Hacked by India’s ‘HIND CYBER GHOST’ group
