“Never paste a command from a web page into Win+R, the Run box or PowerShell. A real ‘I am not a robot’ check never asks for this,” Siemens warned in a blog post published on October 19, as it disclosed active exploitation of a DLL side‑loading bug in its Software Center.
The vulnerability: CVE-2026-110936 and how DLL side‑loading is abused
Siemens said attackers are actively exploiting CVE-2026-110936 (CVSS 8.4) to place malicious dynamic link library (DLL) files into a directory that Siemens Software Center searches for helper files. Version 3.5.8.7 of Software Center, the company acknowledged, loaded helper files from its own folder without verifying them. Attackers use a genuine, signed copy of the application and place their own files alongside it so the signed executable will load the malicious DLLs.
Romulus hosting panel and the ClickFix delivery technique
The activity has been attributed to the Romulus multi‑platform ClickFix campaign. Romulus was identified by Forescout researchers on October 14 and described as a server hosting panel that lets cybercriminals deploy ClickFix tactics across an ecosystem. ClickFix is a social‑engineering technique in which victims are lured into executing attacker‑supplied commands on their own machines; Siemens says the actors then attempt to distribute the malicious files to customers using a ClickFix lure.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIndicators Siemens says to look for
- "Siemens Software Center" appearing in a PC’s start‑up apps or in Task Scheduler on a machine that never had it installed;
- a folder named SM Software Provisioning Service inside AppData\Local\Programs created by the malware;
- files named activate.bak or statinfosta.DB located next to SiemensSoftwareCenter.exe;
- a folder called FTSuite containing a file ftc.uml inside AppData\Local;
- network connections to 96.62.218[.]59.
Siemens advised that detection tools should focus on the presence of these folders and suspicious behavior rather than attempting to flag the Siemens executable itself, because the file used by the attackers is a genuine, signed binary.
Mitigations Siemens recommends: update, isolate, block
Siemens urged customers to update the Software Center to version 4.0.9.8, which the company says contains a fix for the vulnerability. Existing installations, Siemens added, will update automatically the next time they start. The company also told customers to download Siemens software only from official Siemens sources and to block the active IP address and domain listed in the advisory.
If a machine is found to be compromised, Siemens’ recommended immediate steps are to isolate the device, stop the running process first, then remove the start‑up entry and scheduled task, and reset passwords.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: prioritize deployment of Software Center 4.0.9.8, create detections that look for the specific folders and filenames listed above, and add network blocks for 96.62.218[.]59 and the domain in the advisory.
- Affected enterprises and procurement leaders: audit endpoints for unexpected instances of "Siemens Software Center" in startup or Task Scheduler, and verify that Software Center installations are coming only from official Siemens distribution channels.
- End users and administrators: follow Siemens’ guidance not to paste commands from web pages into Win+R, the Run box, or PowerShell; treat any “I am not a robot” style prompt that requests execution of local commands as a likely lure.
The campaign combines a classic application‑control weakness — DLL side‑loading from an application’s local folder — with a human‑targeted delivery method that tricks users into running commands. Siemens’ advisory couples a software patch (4.0.9.8) with concrete detection fingerprints and operational steps (isolate, stop, remove start‑up/task, reset passwords), leaving defenders a clear, actionable checklist: patch rapidly, look for the folder and filenames, and harden operational practices around command execution prompts.
Read the original Siemens advisory and reporting here: https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/
