GajShield Threat Advisory — Romulus ClickFix Campaign Abusing Siemens Software Center (CVE-2026-110936)

Severity: High | Priority: 1

Attackers behind the Romulus ClickFix campaign are abusing a DLL sideloading flaw in Siemens Software Center, tracked as CVE-2026-110936 (CVSS v4 8.4). Versions up to and including 3.5.8.7 load helper DLLs from their own folder without verifying them.

The attack does not need Siemens software already on the victim’s PC. Victims are lured, in some cases through malicious ChatGPT Custom GPTs, to a fake page that tells them to paste a command into the Windows Run box or PowerShell. That command installs AllMyBasic.msi. The MSI drops a genuine, signed copy of SiemensSoftwareCenter.exetogether with a malicious archive.dll. When the trusted Siemens program starts, it loads the attacker’s DLL, which then installs a remote access trojan.

If an alert is raised, treat the source machine as compromised and isolate it from your network. Then check it for:

• SiemensSoftwareCenter.exe running from AppData\Local\Programs or started by msiexec.exe
• a folder named AppData\Local\Programs\SM Software Provisioning Service
• the files activate.bak and statinfosta.DB next to the Siemens executable
• an AppData\Local\FTSuite folder containing ftc.uml
• a “Siemens Software Center” start-up entry or scheduled task, especially on a PC that never had the software installed

To clean the machine:

1. Stop the process.
2. Remove the start-up entry and scheduled task.
3. Delete the files, or rebuild the machine.
4. From a clean device, reset the passwords of users who logged on to it, because the remote access trojan gave the attackers control of that machine.

Find out how the user reached the lure, and block that page if you can.

Whether or not you see alerts:

• Update Siemens Software Center on every machine to 4.0.9.8 or later. Starting the program installs the update.
• Download Siemens software only from official Siemens sources.
• Remind users never to paste commands from a website into Win+R, the Run box or PowerShell, whatever the page claims.
• Search your past firewall and DNS logs for connections to wizardexpensive.com, 96.62.218.59 and 2.27.248.127. These addresses may have been contacted before these rules were deployed.