{"id":3619,"date":"2026-10-20T08:01:06","date_gmt":"2026-10-20T08:01:06","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3619"},"modified":"2026-10-20T08:01:06","modified_gmt":"2026-10-20T08:01:06","slug":"clickfix-attackers-exploit-siemens-software-center-flaw-to-deploy-remote-access-trojan","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3619","title":{"rendered":"ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 20, 2026<\/span><\/span>Vulnerability \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks.<\/p>\n

The high-severity vulnerability, tracked as CVE-2026-110936<\/a><\/strong> (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service.<\/p>\n

\u00abThe affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path,\u00bb Siemens said<\/a> in an advisory. \u00abThis could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.\u00bb<\/p>\n

The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming.<\/p>\n

In a separate alert, Siemens said attackers have abused a genuine copy of Siemens Software Center with a valid signature and placed their own crafted DLL (\u00abarchive.dll\u00bb) next to it to trigger the execution of malicious code.<\/p>\n

\u00abThey chose this program as a carrier because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them,\u00bb Siemens added<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Specifically, threat actors have been found leveraging \u00abmsiexec.exe\u00bb to launch \u00abAllMyBasic.msi,\u00bb which then executes \u00abSiemensSoftwareCenter.exe.\u00bb The activity has been attributed to a ClickFix delivery platform called Romulus, which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using DLL sideloading.<\/p>\n

According to Huntress, some of these campaigns have leveraged malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving a ClickFix lure, which when copied and executed by the victim, runs PowerShell code to drop an MSI installer that abuses DLL sideloading to ultimately deploy a remote access trojan. <\/p>\n

Siemens has shared the following indicators of compromise –<\/p>\n