{"id":3615,"date":"2026-10-20T04:54:25","date_gmt":"2026-10-20T04:54:25","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3615"},"modified":"2026-10-20T04:54:25","modified_gmt":"2026-10-20T04:54:25","slug":"hackers-use-new-romulus-clickfix-platform-to-deliver-legionloader-and-other-malware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3615","title":{"rendered":"Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 20, 2026<\/span><\/span><span class=\"p-tags\">Artificial Intelligence \/ Cybercrime<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8zydF3pRz3L86iRbEdX23esEuSWg0nt4Zq-6jV1oJy7HCuQ0oxZThFma1tspyuxRo0VG0kkCA_GZNobZkykxlZIKUb22Iq7DSwRepN3yIEk5Lfn7EeYUX52_Gkbz0GmerEPMuRP2EZTGegoGZd-p_8zvZKen5n8IZ9bm3_533b1aMXzdRKCNICkYzYJ7z\/s1700-nu-rw-lo-l85-e365\/romulus.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have disclosed details of a ClickFix delivery platform called <strong>ROMULUS<\/strong> that&#8217;s being used to distribute malware such as Legion Loader.<\/p>\n<p>According to Forescout Research &#8211; Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own machines.<\/p>\n<p>\u00abROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators,\u00bb security researcher Sai Molige <a href=\"https:\/\/www.forescout.com\/blog\/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform\/\" target=\"_blank\">said<\/a> in an analysis.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-governance-platform-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhyu3ExJi2vbls3Z9aCvSrcqvhtsSOqXMOIxESfkx7uurTZb7rN3a2eQxwzgZ-j1ioplnCvQFTCYr8w3IUlYx0FrQzDaqQsBsUi885UYvHF3MjAObvO6ptvKBeX6zhQvzAi_KjmVno6a8bYI3Wozti5mHavNFGrekT_gC6JDVY8G3N-aV44-OZJGX9rlLng\/s728-nu-rw-lo-l85-e365\/nudge-1-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The cybersecurity company said it identified six IP addresses running ROMULUS &#8211;<\/p>\n<ul>\n<li>96.62.224[.]81<\/li>\n<li>86.109.75[.]7<\/li>\n<li>151.240.151[.]223<\/li>\n<li>23.94.145[.]224<\/li>\n<li>93.152.224[.]118<\/li>\n<li>2.27.248[.]127<\/li>\n<\/ul>\n<p>Notably, the IP address \u00ab96.62.224[.]81\u00bb was identified as hosting a ClickFix script and an MSI installer file in connection with another campaign that has been found to leverage malicious <a href=\"https:\/\/thehackernews.com\/2026\/09\/attackers-abuse-chatgpt-custom-gpts-to.html\" target=\"_blank\">ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving the ClickFix lure.<\/p>\n<p>Forescout&#8217;s own analysis has since uncovered the same malware being delivered via another server, 86.109.75[.]7, that also hosted a panel codenamed ROMULUS. In addition, a separate chain triggered via ClickFix has been used to run a PowerShell script, which then delivers Legion Loader, a malware loader also called Satacom downloader, CurlyGate, and RobotDropper.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgIRmECX1QgA5jK1oywglo9CXhFEZlvq-nOrYAYQSYiWjqtGWVweVyv7bki4ggr8C7vb6Q-XMYxrs0wxsNmBursHQbYf_8Qr2Xob0kItSPq_kvjzDOdyoEtlNp6K4VV2UF19ly9JkhBNUFAX0nnXRRgSArGPf3Ee-TTqxFxPEWceoCjp-2Ps1EsguLpmfg7\/s1700-nu-rw-lo-l85-e365\/romulus.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgIRmECX1QgA5jK1oywglo9CXhFEZlvq-nOrYAYQSYiWjqtGWVweVyv7bki4ggr8C7vb6Q-XMYxrs0wxsNmBursHQbYf_8Qr2Xob0kItSPq_kvjzDOdyoEtlNp6K4VV2UF19ly9JkhBNUFAX0nnXRRgSArGPf3Ee-TTqxFxPEWceoCjp-2Ps1EsguLpmfg7\/s1700-nu-rw-lo-l85-e365\/romulus.png\" alt=\"\" border=\"0\" data-original-height=\"1024\" data-original-width=\"1536\"\/><\/a><\/div>\n<p>As of writing, it&#8217;s not known who is behind the ROMULUS platform. However, it shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922), a China-aligned threat actor known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially <a href=\"https:\/\/www.jumpsec.com\/guides\/an-emerging-silver-fox-like-cluster-papermill\/\" target=\"_blank\">Venom RAT<\/a> via DLL sideloading techniques.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The ROMULUS platform exposes two endpoints that are designed to download a PowerShell staging script, which decides the payload to be fetched next: a trojanized MSI installer carrying a malware loader or an encrypted archive containing Legion Loader. The loader, for its part, communicates with a remote server to fetch and run additional payloads.<\/p>\n<p>The findings indicate how ClickFix is evolving beyond a social engineering technique into a highly effective entry point for malware. To mitigate the threat, it&#8217;s essential to hunt for suspicious PowerShell commands and DLL sideloading events.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 20, 2026Artificial Intelligence \/ Cybercrime Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that&#8217;s being used to distribute malware such as Legion Loader. According&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3616,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[225,529,338,3844,42,527,3843],"class_list":["post-3615","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-clickfix","tag-deliver","tag-hackers","tag-legionloader","tag-malware","tag-platform","tag-romulus"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3615"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3615\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3616"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}