Siemens revealed on Monday that threat actors exploited vulnerabilities in the Siemens Software Center as part of a malware campaign.
The Siemens Software Center manages the download, installation, activation and update of software purchased by customers, and it can also be used to start a free trial.
Weakness, follow a CVE-2026-110936It exists because the program doesn’t limit the locations it can correctly look for DLL files. A confirmed local attacker could plant a malicious DLL in one of those folders and have their code executed with the same privileges as the Software Center.
Siemens disclosed the flaw on October 15 Consultant which assigned it a CVSS v4 score of 8.4. Two days later, the company updated its guidance to tell customers that version 4.0.9.8 fixed the problem.
Users who have already installed the application will be automatically corrected the next time they open it.
The advisory did not mention the exploit in nature until Monday, when Siemens added a link to a new blog post. Describe the attack.
The attackers paired a valid copy of the Siemens program, which had a valid digital signature, with the malicious DLL file they provided. When the program starts, it loads files provided by the attacker from its own folder.
Siemens noted that version 3.5.8.7, the newest version at the time, did not validate these helper files before loading them.
The company said its software was not tampered with, and the malicious package did not spread through Siemens’ distribution channels.
“No Siemens system, product or upgrade channel has been infringed to our knowledge,” the company said.
Siemens is sharing threat intelligence with authorities and EDR providers. Its blog post lists indicators of compromise (IoCs), as well as signs that a computer may be infected.
Because the Siemens files used in the attack are legitimate, the company recommends that attackers focus on suspicious behavior and malware-related folders instead of relying on file hashes.
Huntress researcher Jose Oregon is credited with reporting the vulnerability to Siemens.
Siemens linked the attack to the Romulus ClickFix operation
Siemens linked the attack to Romulus, a multi-platform ClickFix campaign. The ClickFix attack relies on fake alerts, such as fake CAPTCHA checks, that instruct users to place and execute malicious commands on their own devices.
Last week, Forescout published research on RomulusClickFix is a delivery platform that can serve many different malware payloads. The security firm found the platform running on several servers, including one Siemens identified as a distribution server for malicious packages containing its software.
Forescout has seen the LegionLoader malware delivery platform, as well as trojanized installers that use legitimate Stardock applications for DLL sideloading.
Researchers could not determine who ran Romulus. They said it could be a private tool, a service sold to cybercriminals, an affiliate program, or software copied by different threat actors.
Huntress described the same Stardock-based package in a late September report on a campaign that used malicious ChatGPT Custom GPTs to lure users to ClickFix pages. In those attacks, programs signed by Canon and later Stardock were compromised with malicious code that ultimately used a RAT.
Huntress responded to at least 40 incidents linked to the campaign, and said it believes programs signed by other vendors may also be misused.
Siemens Software Center was not mentioned in the Huntress or Forescout reports. However, the overlapping infrastructure and similar side loading methods indicate that the Siemens project may be added to the same toolkit.
Related: Siemens says Desigo CC Files are flagged as Malware by security engines
Related: Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
Related: ICS Patch Tuesday: Siemens issues 17 recommendations, Rockwell fixes ArmorBlock Takeover bug
Related: Hackers use AI to target Siemens PLCs in key US sectors
