Siemens Warns of Romulus Group Exploiting DLL Side-Loading Flaw in Software Center
Siemens urges immediate updates for Software Center users after Romulus attackers began exploiting a high-severity DLL side-loading vulnerability to distribute malware.
Key points
- Siemens identified active exploitation of CVE-2026-110936 by the Romulus cybercriminal group.
- The flaw allows attackers to load malicious libraries via ClickFix social engineering tactics.
- Users must update to version 4.0.9.8 to patch the vulnerability and remove malicious files.
Siemens has issued a warning to customers regarding active exploitation of a dynamic link library side-loading vulnerability within its Software Center application. The company attributes the ongoing campaign to the Romulus group, which is using the flaw to distribute malware through deceptive ClickFix instructions. This activity was detailed in a Siemens blog post published on October 19.
According to Infosecurity Magazine, Siemens identified the threat actor as the Romulus multi-platform campaign. Researchers from Forescout originally identified the Romulus server hosting panel on October 14. This infrastructure enables cybercriminals to deploy ClickFix tactics across ecosystems, allowing them to repeatedly deliver various forms of malware to victims who follow attacker-supplied commands on their own machines.
Technical Details of the Exploit
The vulnerability, designated CVE-2026-110936, carries a CVSS score of 8.4, which Siemens rates as high severity. Attackers are targeting version 3.5.8.7 of the Software Center, which previously loaded helper files from its own folder without verifying their integrity. By placing malicious files next to a genuine, signed copy of the application, the threat actors can trick the system into loading harmful dynamic link libraries.
If users execute the commands provided in the ClickFix lures, malicious code runs on the device with the same privileges as the affected Siemens application. Siemens stated that detection tools should focus on suspicious folder behavior rather than file fingerprints, because the initial Siemens file used in the attack is genuine and signed.
Who Is Affected
Siemens Software Center users who have not yet updated their installations are at risk. The company confirmed that existing installations will update automatically the next time they start, provided they are configured to do so. Siemens urged all customers to manually ensure they are running version 4.0.9.8, which contains the fix for the side-loading flaw.
Customers should check their systems for specific indicators of compromise. Siemens noted that a compromised PC might show "Siemens Software Center" in start-up apps or Task Scheduler, even if the software was never intentionally installed. Other signs include a folder named SM Software Provisioning Service in the AppData local programs directory, or files named activate.bak and statinfosta.DB located next to the main executable.
What should you do?
If a device shows signs of infection, Siemens advises isolating the machine immediately. Users should stop the malicious process, remove the start-up entry and scheduled task, and reset passwords. The company also warned users never to paste commands from web pages into the Run box or PowerShell, noting that legitimate security checks never require such actions.
What to do and how to stay safe: Siemens
- Verify that your Siemens Software Center is updated to version 4.0.9.8 or later to mitigate the side-loading vulnerability.
- Inspect your Task Scheduler and start-up applications for any unexpected instances of Siemens Software Center.
- Check the AppData local programs directory for folders named SM Software Provisioning Service or FTSuite.
- Educate users to avoid pasting commands from web pages into PowerShell or the Windows Run dialog box.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-110936?
It is a high-severity DLL side-loading vulnerability in Siemens Software Center version 3.5.8.7 that allows attackers to execute malicious code.
Which threat group is behind this attack?
Siemens attributes the activity to the Romulus multi-platform campaign, which utilizes ClickFix social engineering techniques.
How can I tell if my PC is compromised?
Look for Siemens Software Center in start-up apps if it was never installed, or check for specific folders like SM Software Provisioning Service in AppData.
