Security researchers have uncovered a live attack exploiting a side-loading vulnerability in Siemens Software Center, enabling distribution of malware through a signed executable. The flaw, tracked as CVE-2026-110936, affects all Software Center versions earlier than 4.0.9.8. Siemens has acknowledged the breach and rolled out a patch that will automatically update on existing installs as soon as the application starts up.
How the Attack Works
The vulnerability relies on DLL side-loading: when SiemensSoftwareCenter.exe is executed, the application may load malicious libraries placed in its directory without verifying their legitimacy. Even though the executable itself remains signed and unmodified, adjacent unauthorized DLLs are able to hijack the loading process. Normal validation checks focused only on the executable signature might miss this vector entirely.
This exploit is tied to the ClickFix malware chain, part of the broader Romulus campaign, which uses realistic prompts masquerading as repair or verification notices to trick users into facilitating malicious activity. Earlier incidents involved Python tunnels, modified installers, PowerShell scripts, and hidden libraries loaded by benign software. During this attack, Siemens Software Center version 3.5.8.7 was used to deliver the payload.
Indicators & Response Recommendations
Siemens provided specific Indicators of Compromise (IoCs) to help organizations detect infection. Key signs include unexpected startup entries or scheduled tasks for Siemens Software Center, particularly if the user did not install it. Malware may reside under paths like %LOCALAPPDATA%\Programs\SM Software Provisioning Service, with suspicious files such as activate.bak or statinfosta.DB alongside the signed executable. In earlier stages, a folder named FTSuite under %LOCALAPPDATA%\FTSuite\ftc.uml was observed.
Infrastructure associated with the malware includes active hosts at IP addresses like 96.62.218[.]59 and wizardexpensive[.]com. An MSI installer payload has been identified (SHA-256 hash f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a), as well as a malicious DLL with hash 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491. All historical connections to now-inactive hosts should also be investigated.
To defend effectively, affected users must upgrade to Software Center version 4.0.9.8 or later and ensure updates come only from official Siemens sources. Security teams should block known malicious infrastructure, scour logs for past communications with those C2 domains and IPs, terminate unauthorized processes, and clean up any rogue startup tasks or scheduled jobs. Renewing compromised credentials and implementing behavioral monitoring are also strongly advised.
This CVE was disclosed in Siemens’ advisory SSA-580366 on October 15, with the company confirming the existence of active exploits by October 19. Although Siemens reports no known breach of its core systems or update channels, the use of a legitimate signed executable in this attack highlights how trust in code signing can be abused when supporting files are overlooked.
Attackers should never latch onto delays in patching. Even though Siemens has pushed out a fix, auto-updates may not reach every system immediately. Organizations relying on Siemens Software Center should proactively verify version numbers, inspect file paths, and monitor unexpected behavior as part of a layered defense strategy.
