Siemens has resolved a serious security flaw in its Software Center that was being exploited by the ClickFix threat actors to deploy a Remote Access Trojan (RAT). The issue, identified as CVE-2026-110936 with a CVSS v4 rating of 8.4, allowed an attacker to plant a malicious DYNLINK library (DLL) in a directory that Software Center searches, resulting in arbitrary code execution with the same privileges as the affected service. The bug has been patched in version 4.0.9.8. A researcher from Huntress Labs discovered the vulnerability.
How the Attack Works
Threat actors leveraged a copy of Siemens Software Center that was legitimately signed and trusted. They placed a crafted DLL named “archive.dll” alongside the authentic executable. This setup exploited a helper file loading routine in version 3.5.8.7, which loaded DLLs from its own installation folder without validating their origin.
The attack flow also involves Windows’ msiexec.exe, which launches a malicious MSI installer named AllMyBasic.msi. That installer triggers DLL sideloading, leading to the RAT deployment. The operation has been linked to a ClickFix delivery platform dubbed Romulus, previously tied to Legion Loader and similar malware using DLL sideloading.
Social Engineering & Custom Tools Aid Delivery
Some attacks blended AI-assisted social engineering with malware infrastructure. Custom GPTs powered by ChatGPT were reportedly used to guide victims to counterfeit URLs hosting ClickFix lures. Once a target downloads and executes what appears to be harmless, the attack chain uses PowerShell to drop the MSI that kicks off the DLL sideloading and RAT deployment.
Rules for Organizations to Defend Against It
Siemens has released several Indicators of Compromise (IoCs) tied to this campaign, including IPs like 96.62.218.59 and 2.27.248.127, and domains such as wizardexpensive[.]com. Organizations still using affected versions should upgrade Software Center to 4.0.9.8 or later, apply the patch, and then restart the application. Additional mitigations include blocking the listed IPs and domains, checking for “SiemensSoftwareCenter.exe” executing from the AppData\Local\Programs path, and verifying whether it’s being invoked by msiexec.exe.
This flaw highlights how DLL sideloading remains a potent technique for privilege escalation and malware deployment. It’s especially dangerous because attackers used a legitimate, signed program to carry out the exploit. As more threat actors incorporate AI tools like custom GPTs into their social engineering tactics, even skilled defenders face steeper challenges.
