Siemens Software Center flaw exploited in ClickFix DLL attacks

Siemens has confirmed that a vulnerability in Siemens Software Center, the program customers use to download, install, activate and update the Siemens software they have bought (and to start free trials), has been exploited in a malware campaign based on ClickFix. The attackers did not compromise Siemens: they took a legitimate, signed copy of the program and distributed it together with malicious DLLs of their own.

What happened

The vulnerability is CVE-2026-110936, with a CVSS v4 score of 8.4. According to SecurityWeek, Siemens disclosed it on 15 October 2026; two days later the advisory was updated with the fixed version, 4.0.9.8. On 19 October Siemens added to the advisory a link to a post on its blog describing the ongoing attacks.

The flaw is an uncontrolled DLL search path: the program does not properly restrict the folders in which it looks for the libraries to load. An authenticated local attacker can therefore place a malicious DLL in one of those folders and have it executed with the same privileges as Software Center. Siemens acknowledged that version 3.5.8.7, the latest at the time of the attacks, loaded helper files from its own folder without checking them.

The company states that its software was not tampered with and that the malicious package did not go through Siemens distribution channels: “No Siemens system, product or update channel was breached to our knowledge.” Siemens is sharing threat information with authorities and EDR vendors. According to SecurityWeek, the vulnerability was reported by Jose Oregon, a researcher at Huntress.

The attack chain

Based on the descriptions by SecurityWeek and Infosecurity Magazine, which report on the Siemens post, the attack works as follows:

1. ClickFix lure: a web page shows a fake “I am not a robot” style check and asks the victim to paste a command into the Run dialog (Win+R) or PowerShell.
2. Package delivery: the command brings onto the computer a genuine copy of SiemensSoftwareCenter.exe, with a valid digital signature, along with the attacker’s DLLs.
3. DLL side-loading: at startup the program loads the attacker-supplied libraries from its own folder, and they run with the application’s privileges.
4. Persistence and outbound connection: the Siemens indicators include a startup entry or scheduled task named “Siemens Software Center” and connections to an attacker-controlled address.

The Hacker News headline names a remote access trojan (RAT) as the final payload; the full text of that article was not available for this analysis.

The link to Romulus

Siemens attributes the activity to Romulus, a multi-platform ClickFix campaign. Forescout described it on 14 October: Infosecurity Magazine calls it a server hosting panel that lets criminals reuse ClickFix tactics to deliver different kinds of malware, SecurityWeek a delivery platform able to serve several payloads. According to SecurityWeek, Forescout found the platform on several servers, including the one Siemens identifies as the distribution server for the package containing its program, and saw it deliver the LegionLoader loader and a trojanized installer that abused a legitimate Stardock application for the same side-loading. Who runs Romulus is unknown.

SecurityWeek also recalls a late-September Huntress report: rogue ChatGPT Custom GPTs lured victims to ClickFix pages, and signed programs from Canon and later Stardock were used to load malicious code that ended with a RAT, with at least 40 incidents handled. Neither Huntress nor Forescout mentions Siemens Software Center: according to SecurityWeek, the shared infrastructure and similar technique suggest the Siemens program was added to the same toolkit.

Indicators of compromise

The indicators published by Siemens and reported by Infosecurity Magazine:

• “Siemens Software Center” among the startup apps or in Task Scheduler on a PC where the program was never installed;
• the folder SM Software Provisioning Service in AppData\Local\Programs;
• the files activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe;
• the folder FTSuite containing the file ftc.uml in AppData\Local;
• network connections to 96.62.218[.]59.

The Siemens post also lists an active domain, which is not reported by the available sources.

MITRE ATT&CK techniques

• User Execution: Malicious Copy and Paste (T1204.004), the command pasted by the victim;
• Hijack Execution Flow: DLL (T1574.001), which in ATT&CK includes DLL side-loading;
• Scheduled Task (T1053.005) and Boot or Logon Autostart Execution (T1547), for persistence.

Impact for European and Italian companies

The tricky point is that the executed file is genuine and signed: controls based on signatures or on hashes of known files treat it as trustworthy. That is why Siemens recommends not hunting for its file’s fingerprint, but focusing on the folders used by the malware and on suspicious behaviour. The first indicator also shows that the package hits computers with no Siemens software at all: updating legitimate installations closes the vulnerability, but does not stop attackers from bringing the vulnerable version along.

Manufacturing and engineering companies that use Siemens software are a credible target for a lure carrying that name. For NIS2 entities, staff training against social engineering and control over installed software are part of the risk management measures.

What to do now

1. Update Siemens Software Center to 4.0.9.8: existing installations update themselves at the next launch; check that this has happened.
2. Hunt for the listed indicators, starting with SiemensSoftwareCenter.exe in unusual paths, such as AppData\Local\Programs, or on machines where it should not be.
3. Block the address 96.62.218[.]59 and the domain listed in the Siemens post.
4. Download Siemens software only from official sources.
5. If you find a compromised PC, as Siemens advises: isolate it, stop the process first, then remove the startup entry and the scheduled task and reset passwords.
6. Tell your staff with the Siemens message: never paste a command from a web page into Win+R, the Run box or PowerShell; a real “I am not a robot” check never asks for this.

How ARXDOME helps

ARX Sentry collects logs and security events from computers and servers and groups them into families such as suspicious executions and persistence, with MITRE ATT&CK tactics in the SOC pages. With ARX Trace, analysts run searches across multiple machines and review file changes, useful for finding the folders and files listed by Siemens. ARX Horizon lets you query threat intelligence sources about the indicators, and ARX Shield lets you isolate a suspicious computer from the network.

Last updated: 20 October 2026