By 
In a troubling revelation, Siemens has announced that a vulnerability in its Software Center has been targeted by threat actors as part of a sophisticated malware campaign. Designed to facilitate the download, installation, and updating of its software, Siemens Software Center plays a pivotal role in managing the software that customers rely on, including options for free trials. The flaw, identified as CVE-2026-110936, stems from insufficient restrictions on the search locations for DLL (Dynamic-Link Library) files, creating an avenue for potential exploitation.
The critical nature of this vulnerability is underscored by its high CVSS v4 score of 8.4, which Siemens disclosed in an advisory issued on October 15. Two days later, the company confirmed that a patch, available as version 4.0.9.8, had been deployed to address the issue. Users of the application will receive this update automatically upon their next launch. However, the gravity of the situation became more apparent when Siemens updated its advisory to acknowledge that the vulnerability had indeed been exploited in the wild.
The malicious activities associated with this vulnerability employed a previously legitimate version of Siemens Software Center, which featured a valid digital signature. Attackers paired this trusted software with their own malicious DLL files. Once the software executed, it inadvertently loaded the attackers' files, allowing them to run code with the same level of access as the Software Center itself. Siemens has made clear that its own software remained unaltered and that the malware was not disseminated through any of Siemens' distribution channels. The company reassured users by stating, "No Siemens system, product or update channel was breached to our knowledge."
As the company continues to assess the situation, it is collaborating with security authorities and endpoint detection and response (EDR) providers to share vital threat intelligence. In this context, Siemens has provided indicators of compromise (IoCs) and guidance on recognising potential signs of infection. Given the nature of the attacks, which leveraged a legitimate software file, Siemens encourages defenders to look for any suspicious activity and focus on folders associated with the malware rather than relying solely on file hashes, which can often be misleading in such scenarios.
The vulnerability has been linked to a broader malware campaign known as Romulus, specifically utilising the ClickFix operation. This series of attacks employs deceptive prompts that trick users into executing malicious commands on their own devices. Last week, cybersecurity firm Forescout published findings connected to the Romulus operation, highlighting its extensive capabilities as a delivery platform serving various malware types. Notably, Forescout identified the distribution server responsible for disseminating the malicious package containing Siemens' software.
This ClickFix operation has proven to be versatile, delivering various types of malware in addition to the recent attacks involving Siemens software. Among the payloads identified are LegionLoader and a trojanised installer that misuses a legitimate Stardock application for harmful DLL side-loading. The identity of the individuals or groups behind Romulus remains unclear, leaving open the possibility that it may be operated as a private tool, marketed as a service to other cybercriminals, or even shared among various threat actors.
The similarities between various campaigns utilizing the ClickFix method further indicate a worrying trend in software security. Huntress, another cybersecurity research firm, recently described similar tactics involving signed programs from both Canon and Stardock in previous attacks. These incidents highlighted the use of legitimate software to execute malicious code, often resulting in more severe infections such as Remote Access Trojans (RATs).
While Siemens Software Center does not explicitly feature in the reports published by Huntress or Forescout, the methodologies employed and overlapping techniques suggest that Siemens’ software has been integrated into a broader toolkit exploited by various cybercriminals. This development signals a potential shift in how attackers approach software supply chain vulnerabilities, prompting heightened vigilance and a re-evaluation of security practices by businesses and users alike.
As these developments unfold, it is essential for organisations to stay informed about the latest security measures and patches, reacting swiftly to updates from software providers such as Siemens. With the risks posed by such vulnerabilities escalating, proactive strategies and measures will play critical roles in safeguarding systems and data from increasingly sophisticated cyber threats.
Source: securityweek.com
