Forescout analysts found six servers running a single delivery platform
Researchers at Vedere Labs, a part of Forescout Research, reported in a blog post published on October 14 that they identified six different servers running a previously unseen panel called ROMULUS. The platform was discovered while investigators were following up on an incident and led to the observation that the exact same malware tied to a separate ClickFix campaign was also connected to another server linked to that investigation.
ROMULUS: a reusable, multi‑payload ClickFix delivery backend
Analysis by Vedere Labs shows ROMULUS is not a one‑off server for a single strain of malware; rather, it behaves as a shared delivery backend able to dispatch multiple payloads. Researchers describe ROMULUS as a new "multi‑payload shared ClickFix delivery platform," which suggests cybercriminals can re‑use the infrastructure across different campaigns and likely across different operators or affiliates.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleClickFix as the enabler: social engineering that bypasses protections
ClickFix is central to ROMULUS’s operation. The technique relies on social engineering to trick a real, trusted user into running attacker‑supplied commands on their own machine. Because ClickFix depends on actions by an authenticated user, those actions "often bypass any security protections that may be in place to stop unauthorized action," Vedere Labs noted. That dynamic turns a social technique into an effective entry point for automated distribution infrastructure.
Disguises and delivery tricks: LegionLoader and an 842 MiB executable
ROMULUS has already shown an unusual method for obscuring malicious activity. One delivery route observed distributed LegionLoader, described by the researchers as a "multi‑pronged malware delivery platform," via encrypted archives that contained an executable artificially inflated to approximately 842 MiB. The researchers highlighted that such inflation could allow the archive and its contents to exceed file‑size limits imposed by security scanning and analysis tools, complicating detection and analysis.
Operator identity, family ownership, and relation to RomulusLoader
Vedere Labs reported that the identity of the operator behind ROMULUS and any common ownership of the final malware families remain unknown. The researchers also distinguished ROMULUS from a different malware family: they noted that this platform is separate from RomulusLoader, a form of malware identified by researchers at Proofpoint earlier in 2026.
What this means for security teams, procurement leaders, and end users
- Security teams and technologists: Expect ClickFix‑style social engineering to be used as an entry point into shared, reusable delivery infrastructure rather than as a one‑off trick. Detection strategies that rely solely on file‑based scanning may be circumvented by tactics such as large, inflated executables inside encrypted archives.
- Procurement leaders and enterprise IT: The presence of multi‑tenant delivery platforms like ROMULUS underscores the risk that third‑party‑oriented infection vectors can scale; controls that assume single‑campaign threat actors may under‑estimate exposure.
- End users and administrators: Because ClickFix depends on a legitimate user running commands, user education and controls that limit command execution in high‑risk contexts remain important complements to automated scanning.
ROMULUS represents a technical and operational shift: ClickFix has moved from an isolated social engineering trick into the foundation for a shared, multi‑payload delivery ecosystem. The platform’s reuse across at least six servers, its use of encrypted archives and a notably large, inflated executable, and the open question of who operates it and which malware families ultimately benefit all point to a practical reality for defenders — attacks are being packaged for scale and disguised for evasion. The next concrete question left by the record is who controls ROMULUS and which criminal customers, if any, are consistently using it.
