Forescout Researchers Identify ROMULUS Platform in ClickFix Malware Campaigns
Analysts found a shared delivery backend using six servers to distribute multiple malware payloads via social engineering tactics, marking an evolution in cybercriminal infrastructure.
Key points
- Forescout researchers identified ROMULUS as a reusable ClickFix delivery platform operating across six distinct servers.
- The infrastructure distributes various payloads, including LegionLoader and trojanized Stardock applications, using obfuscated PowerShell scripts.
- This discovery links recent ChatGPT Custom GPT abuse campaigns to broader malware distribution networks, as reported by GBHackers.
Cybersecurity analysts at Vedere Labs, a division of Forescout Research, identified a new malware delivery platform named ROMULUS on October 14. The findings reveal how attackers are transforming the ClickFix social engineering technique into a scalable, reusable infrastructure for distributing multiple malicious payloads.
The ROMULUS platform operates across six separate servers, allowing cybercriminals to deliver different types of malware through a single backend. According to Infosecurity Magazine, this shift indicates that ClickFix is evolving from a simple delivery method into a comprehensive cybercriminal ecosystem.
Infrastructure and Delivery Mechanisms
Researchers discovered ROMULUS while investigating an incident involving malware hosted on server 86.109.75[.]7. They found that this server hosted the same malware samples previously delivered through 96.62.224[.]81. GBHackers reported that Huntress had linked the latter server to attackers abusing ChatGPT Custom GPTs to direct victims to fake verification pages.
The ROMULUS platform uses distinct endpoints for different payload types. Forescout noted that the /s/<token> endpoint delivers PowerShell staging scripts, while /app/<token> distributes trojanized MSI installers. Each token consists of 12 hexadecimal characters, enabling configurable delivery routes rather than a single hard-coded malware family.
One delivery route distributes LegionLoader through encrypted archives containing an executable artificially inflated to approximately 842 MiB. This size may exceed file-size limits imposed by security scanning tools, helping to disguise the malicious activity. Another route downloads a trojanized IconEdit2Turb.msi installer using decimal IPv4 notation to bypass detection.
Impact and Detection Challenges
The installation process for the Stardock route saves a GUID-prefixed installer in the %TEMP% directory and removes download-blocking markers. The script then invokes msiexec.exe silently with /qn and /norestart flags. This launches legitimate DeElevate64.exe, which loads a patched DeElevator64.dll to redirect execution into the malicious I++u.dll.
Recovered scripts use layered integer-array obfuscation and reconstruct executable code through [scriptblock]::Create before deleting themselves. This self-deleting behavior complicates forensic analysis. The platform also exposes a /stats.htm page displaying installation counts, geographic distribution, and historical activity, suggesting a commercial or shared service model.
The identity of the operator behind ROMULUS remains unknown. However, the presence of six matching servers and shared infrastructure with previously documented campaigns suggests a widespread toolkit available to various threat actors. This aligns with earlier reporting by Threat Times on October 16, which highlighted the connection between ClickFix campaigns and Vice Society ransomware loaders.
What should you do?
Organizations should monitor for unusual PowerShell execution patterns, particularly those involving self-deleting scripts or large, encrypted archives. Security teams should verify the integrity of downloaded installers and check for known trojanized applications like Stardock packages.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Forescout
- Monitor network traffic for connections to unknown IP addresses, especially those using decimal IPv4 notation to disguise destinations.
- Review PowerShell logs for scripts that use [scriptblock]::Create or exhibit self-deleting behavior after execution.
- Validate the source and hash of MSI installers before execution, particularly those downloaded via social engineering prompts.
- Educate users on the risks of following ClickFix instructions from unverified sources, such as fake verification pages.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is ROMULUS?
ROMULUS is a shared ClickFix delivery platform identified by Forescout researchers, operating across six servers to distribute multiple malware payloads.
How does ROMULUS evade detection?
It uses techniques such as inflating executables to 842 MiB, decimal IPv4 notation for downloads, and self-deleting obfuscated PowerShell scripts.
Is there a known fix for ROMULUS?
No specific patch or fix has been confirmed yet, as ROMULUS is a delivery infrastructure rather than a single software vulnerability.
