Attackers are using a real, signed Siemens program as cover to sneak malware onto Windows PCs, Siemens confirmed Monday. Those behind the attacks have done the same with signed programs from Canon, the Japanese camera and printer maker, and Stardock, a Michigan maker of Windows desktop utilities.
The high-severity flaw, tracked as CVE-2026-110936, is in the Siemens Software Center, the tool Siemens customers use to download, install, activate and update licensed software. The hack works because this specific program does not restrict where it searches for DLL files upon launch, so it loads libraries placed in its own folder. Siemens rates the bug 8.4 under CVSS v4 and 6.7 under CVSS v3.1.
Siemens fixed the flaw in version 4.0.9.8, released Oct. 17, and existing installations update automatically the next time they start. Siemens has not said how many people were hit. Because attackers supply their own copy of the program, victims need not be Siemens customers.
Fix Available, Scope Unknown
The attacks start with a ClickFix lure, a fake prompt such as a bogus CAPTCHA check that tells the user to paste a command into the Windows Run box or PowerShell. In the chain Forescout documented, that command fetches a script that silently installs an MSI package into the user’s AppData folder.
How the Attack Works
In the Siemens case, the package, named AllMyBasic.msi, carried a genuine, signed copy of Siemens Software Center from before the fix, alongside the attackers’ DLLs. When the Siemens program starts, it loads the attackers’ code. Siemens said its software was not modified and none of its systems, products or update channels were breached, to its knowledge.
Both CVSS scores assume an attacker already holds high privileges to plant a DLL. The attackers sidestepped that by installing the whole folder themselves, inside the user’s own profile, where Windows normally does not require administrator rights.
Version 3.5.8.7, the newest release at the time, did not validate those helper files. Siemens disclosed the flaw Oct. 15 and released version 4.0.9.8 on Oct. 17.
The Romulus Connection
Siemens linked the attacks to Romulus, a malware delivery platform that Forescout Research’s Vedere Labs documented Oct. 15. Forescout found Romulus on six IP addresses, delivering the LegionLoader malware and a trojanized Stardock tool that used the same side-loading technique. One of those addresses, 2.27.248.127, is the server Siemens says distributed the malicious Siemens bundle.
LegionLoader, active since 2019 and also known as Satacom and CurlyGate, is a downloader. It registers an infected PC with its operators, then waits for orders to fetch more malware or run PowerShell code. Netskope reported last year that LegionLoader campaigns installed a fake “Save to Google Drive” browser extension that stole cookies and browsing history and watched for Bitcoin activity.
Chatbots as Bait
The same operation has used AI chatbots as bait. Huntress found attackers buying Google search ads on “chatgpt” that led to a fake Custom GPT called “Plus 5.6.” It told every visitor the service was overloaded and sent them to a “backup domain” dressed as a Cloudflare CAPTCHA check, which instructed them to paste a command. Huntress traced at least 40 incidents to that lure page. Forescout found the campaign’s server among those running Romulus.
Huntress researcher Jose Oregon reported the Siemens flaw.
The patch Has a Limit
The fix protects legitimate installations, which update the next time they start. It does nothing about the older signed copy attackers ship themselves. Siemens did not say whether it will revoke the certificate used to sign the vulnerable build.
Siemens advises hunting by location and behavior, since the Siemens file itself is genuine. Red flags include SiemensSoftwareCenter.exe on PCs that never had it installed, especially running from AppData\Local\Programs, launched by msiexec, or registered in startup apps or Task Scheduler. Siemens also lists a folder named SM Software Provisioning Service and the files activate.bak and statinfosta.DB beside the program.
Siemens has not said how many victims it has identified, and no public proof-of-concept exploit has surfaced. Forescout could not determine who operates Romulus.
