Romulus

Reported Context (5)

(CVE-2026-110936, CVSS score: 8.4) that has been abused in ClickFix attacks using a platform called Romulus. CISA Sets Patch Deadlines for Exploited Plex2Shell, Siemens and SiteGuard Flaws
The German technology giant warned on October 19 that hackers were leveraging the vulnerability in campaigns linked to a multi-payload ClickFix delivery platform called Romulus. CISA Warns of Active Exploitation of Plex2Shell and Other Flaws
The vulnerability has already been weaponized in ClickFix activity linked by Siemens to the Romulus delivery platform. Siemens Software Center DLL Side-Loading Flaw Exploited in ClickFix Attacks
"SiemensSoftwareCenter.exe." The activity has been attributed to a ClickFix delivery platform called Romulus, which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using Siemens Patches Software Center DLL Sideloading Flaw Exploited in ClickFix Attacks
Siemens links the attacks to the Romulus ClickFix operation Siemens Software Center DLL Vulnerability Exploited in ClickFix Campaign

CVE (6)

Malware (2)

People (3)

MITRE ATT&CK (5)

Vendors (5)

Products (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.