Siemens Software Center Vulnerability Under Active Attack

A Fake Robot Check, a Real Signature, and a Hijacked Siemens App

Attackers found a way to run malware under a real Siemens signature. They never touched the file. They parked a rogue DLL next to it and let a trusted program load the code.

What Happened?

Siemens posted an advisory on October 15 for a flaw in its Software Center, tracked as CVE-2026-110936 and scored 8.4 on CVSS v4.0. On October 17, it named version 4.0.9.8 as the fix. By October 19, it confirmed the flaw was already under attack.

The method was cheap. A rogue installer called AllMyBasic.msi dropped a genuine, signed copy of SiemensSoftwareCenter.exe into a user folder. The older build, 3.5.8.7, loaded helper files next to it without verifying them. One of those files, archive.dll, was the malware. The trusted app ran it, and the signature held up the whole time.

What’s the Impact?

Victims get in through ClickFix, where a fake robot check asks you to paste a command into the Run box. Nothing downloads. Nothing opens. Email filters see no attachment, and endpoint tools see a valid Siemens signature and step aside.

ClickFix keeps growing. ESET logged a 108% rise in ClickFix detections between the second half of 2025 and the first half of 2026. One security firm worked at least 40 incidents in a related campaign in late September that abused other vendors’ signed software in the same way.

IOCs (Indicators of Compromise)

IOCs · CVE-2026-110936 · Romulus ClickFix

Indicators of compromise: Siemens Software Center sideloading

Values are defanged. Refang before loading into a blocklist or hunt query. The carrier executable is genuine and signed, so hash matching on it will miss the attack. Hunt the folder and the behavior.

Network

3 indicators

96.62.218[.]59ActiveIP · payload hosting and C2

wizardexpensive[.]comActiveDomain · payload hosting and C2

2.27.248[.]127InactiveIP · distributed AllMyBasic.msi. Still search historical logs.

File hashes

SHA-256

f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4aMSIAllMyBasic.msi · the dropper bundle

3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491DLLarchive.dll · sideloaded DLL that starts the RAT chain

Host artifacts and process lineage

Hunt these first

msiexec → SiemensSoftwareCenter.exeProcess lineage. The signed carrier running from %LOCALAPPDATA%\Programs, launched by msiexec.

%LOCALAPPDATA%\Programs\SM Software Provisioning ServiceFolder dropped by the installer

%LOCALAPPDATA%\FTSuite\ftc.umlSecondary folder and file

activate.bak · statinfosta.DBDropped beside SiemensSoftwareCenter.exe

Startup app or scheduled task named for Software CenterOn a machine where Software Center was never installed

Wider Romulus panel infrastructure

Context

96.62.224[.]81 · 86.109.75[.]7 · 151.240.151[.]223
23.94.145[.]224 · 93.152.224[.]118 · 2.27.248[.]127Six hosts observed running the Romulus panel. The last one overlaps with the Siemens campaign.

orbitflownetwork[.]lol · smashshape[.]com · novatrafficcore[.]lolArchive delivery, LegionLoader C2, and an earlier stager. The stager link is unconfirmed.

/api/login · /s/<token> · /app/<token> · /stats.htm · /nfront.php · /nback.phpPanel routes. /s/ serves the PowerShell stager, /app/ serves the trojanized MSI, the php paths are LegionLoader C2.

Detection guidance

Detect on folder and behavior, not on the Siemens file fingerprint. The executable is legitimately signed, so any hash based rule on it is dead on arrival. Alert instead on a signed vendor binary launching from a user writable path, on msiexec as the parent process, and on unexpected DLLs sitting beside a vendor executable outside its normal install directory.

Sources: Siemens ProductCERT advisory SSA-580366 and its active exploitation notice of 19 October 2026; Forescout Vedere Labs research on the Romulus delivery panel. Status values reflect vendor reporting at publication and go stale quickly. Verify before blocking.

One Panel, Many Payloads

The activity traces back to Romulus, a delivery platform researchers at Forescout found while investigating an incident. Romulus is a shared backend. It hands out a PowerShell staging script, then picks a payload: a trojanized MSI loader, or an encrypted archive carrying LegionLoader, a stealer that digs through saved browser data.

Researchers counted six servers running the panel. One of them, 2.27.248.127, is the same address Siemens named as the source of AllMyBasic.msi. Nobody has pinned down who runs it. It could be a private panel, a paid delivery service, an affiliate setup, or copied software.

Siemens says none of its own systems, products, or update channels were breached, and that it is sharing intelligence with EDR vendors and authorities.

How to Avoid This

Patch Software Center to 4.0.9.8
Block the published IPs and domain
Alert on signed apps launching from AppData
Flag msiexec spawning vendor executables
Teach staff: never paste commands from a web page

If You Think You Were Hit

Isolate the machine first. Stop the process, pull the startup entry and the scheduled task, then delete the SM Software Provisioning Service and FTSuite folders. Reset every password used on that box, and search old logs for traffic to the listed infrastructure.

When the File Checks Out, Behavior Is the Only Tell

A signed binary walks past most of the stack. Catching this means watching process lineage, odd folders, and outbound traffic- the slow work that eats a security team’s week.

Red Teammate replays sideloading paths against your own builds and shows what is actually exploitable
SOC Teammate tracks lineage like msiexec launching a vendor binary from AppData, then assembles the case
Blocks and hardening go out through approval gates your team defines
Every action, approval, and outcome is logged for the auditor
A retest proves the gap closed instead of adding another ticket

Signed, Trusted, Hijacked: Attackers Turn a Siemens App Into a Malware Carrier