Siemens has confirmed that attackers are exploiting CVE-2026-110936, a high-severity (CVSS v4 8.4) DLL side-loading flaw in Siemens Software Center, the tool used to download, install and activate Siemens software. According to Siemens, the attackers took a genuine, validly signed copy of the program and placed their own DLL (archive.dll) next to it, because the then-latest version 3.5.8.7 loaded helper files from its own folder without checking them. The Siemens program itself was not modified, and Siemens says no Siemens system, product or update channel was breached to its knowledge.
The activity is tied to ROMULUS, the ClickFix delivery platform Forescout described last week (see our earlier post on ROMULUS). Per The Hacker News, Huntress reported that some of these campaigns used malicious ChatGPT Custom GPTs to send victims to a fake page with a ClickFix lure, which has them paste PowerShell that drops an MSI installer. The installer abuses the side-loading to deploy a remote access trojan. Siemens published the fix in version 4.0.9.8 with advisory SSA-580366 on October 15 and its active-exploitation notice on October 19.
How to check if you’re affected
Affected versions are all Siemens Software Center releases earlier than 4.0.9.8. Siemens says existing installations update automatically the next time the application starts, and that anyone should only download Siemens software from official Siemens sources.
Signs of compromise listed by Siemens:
- A “Siemens Software Center” start-up entry or scheduled task on a PC that never had it installed.
- A folder named
SM Software Provisioning ServiceunderAppData\Local\Programs, created by the malware. - Files named
activate.bakorstatinfosta.DBnext toSiemensSoftwareCenter.exe, or a folderFTSuitecontainingftc.umlunderAppData\Local. SiemensSoftwareCenter.exerunning fromAppData\Local\Programsand started bymsiexec.exe.- Network connections to 96.62.218[.]59 or wizardexpensive[.]com; Siemens also lists 2.27.248[.]127 as the now-inactive distribution channel for
AllMyBasic.msi. Hashes are in the Siemens notice (AllMyBasic.msi,archive.dll).
Siemens advises detecting on folder and behavior, not on the Siemens file fingerprint, since the file itself is genuine. If you find a match, isolate the PC, stop the process first, then remove the start-up entry and task and reset passwords. Siemens also repeats the standard ClickFix warning: never paste a command from a web page into the Run box or PowerShell.