Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Siemens Software Center
Incident: Exploitation of a DLL sideloading vulnerability in Siemens Software Center to deploy a Remote Access Trojan (RAT).
Impact: Arbitrary code execution with high privileges leading to full system compromise.
Attacker: Romulus (ClickFix delivery platform)
Analysis: The campaign leverages a DLL sideloading vulnerability (CVE-2026-110936) in the Siemens Software Center to bypass security checks using a signed binary. Initial access is gained through ‘ClickFix’ lures, some of which are distributed via malicious ChatGPT Custom GPTs. Once the victim executes the lure, a malicious MSI is dropped that sideloads a Trojan to establish remote control.
Recommendations: Update Siemens Software Center to version 4.0.9.8 or later immediately.; Block network traffic to 96.62.218[.]59, 2.27.248[.]127, and wizardexpensive[.]com.; Monitor for msiexec.exe launching SiemensSoftwareCenter.exe from AppData\Local\Programs.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source