ClickFix Crew Weaponizes Signed Siemens Software Center Binary to Sideload RAT (CVE-2026-110936)

A signed, trusted Siemens binary is being used as the launch vehicle for a remote access trojan. Siemens confirmed on October 20, 2026 that threat actors running ClickFix campaigns abused a genuine copy of Siemens Software Center, complete with a valid digital signature, and placed a crafted DLL named archive.dll next to it. When the Siemens executable started, it loaded the attacker's DLL from its own folder without checking it, and the malicious code ran under the cover of a legitimate industrial vendor's software.

The underlying weakness is tracked as CVE-2026-110936, rated 8.4 on CVSS v4. Siemens has fixed it in Siemens Software Center 4.0.9.8. Huntress Labs researcher Jose Oregon is credited with finding and reporting the flaw.

The Vulnerability: Uncontrolled DLL Search Path

Siemens describes the flaw as a classic uncontrolled search path issue. In the advisory, the vendor states that the application loads dynamic-link libraries from an uncontrolled search path, which could allow an authenticated local attacker to place a specially crafted DLL in a directory the application searches, leading to arbitrary code execution with the privileges of the affected application.

In a separate alert, Siemens explained why attackers picked this program. It is signed and trusted, and version 3.5.8.7, the latest release at the time of the campaign, loaded helper files from its own folder without verifying them. That combination is ideal for DLL sideloading: security tooling sees a reputable, signed Siemens process, while the code actually executing belongs to the attacker.

The Attack Chain

Huntress and Siemens together describe a multi-stage intrusion that starts with social engineering and ends with persistent remote access:

• Lure: some campaigns used malicious ChatGPT Custom GPTs to steer victims to a fake URL hosting a ClickFix page.
• ClickFix: the page instructs the victim to copy and execute a command, which runs PowerShell code on the host.
• Installer: the PowerShell stage drops an MSI package, and msiexec.exe launches AllMyBasic.msi.
• Sideload: the MSI executes SiemensSoftwareCenter.exe, which loads the attacker-supplied archive.dll from its own directory.
• Payload: the sideloaded code deploys a remote access trojan.

The use of Custom GPTs as the first hop is notable. Users who trust output from an AI assistant are less likely to question a link it provides, and the ClickFix step then turns that trust into user-initiated code execution, which sidesteps many email and attachment controls entirely.

Attribution: The Romulus ClickFix Platform

The activity has been attributed to Romulus, a ClickFix delivery platform that Forescout documented the week before Siemens' disclosure. Forescout reported Romulus being used to deliver Legion Loader and other malware families, with DLL sideloading as a recurring technique. The Siemens Software Center abuse fits that pattern: Romulus operators appear to rotate signed carrier binaries that will load an adjacent DLL, and the Siemens executable was one such carrier.

Platform-style delivery matters for defenders. A shared ClickFix service means the same lure infrastructure and loading tradecraft can push different final payloads for different customers, so the RAT seen today is not a reliable predictor of what the next wave delivers.

Why This Lands in the ICS/OT Lane

Siemens software is a fixture in industrial environments, and Siemens-signed processes are often treated as expected, low-risk activity on engineering and operations hosts. Attackers exploit exactly that expectation. A RAT running behind a Siemens process name and signature on a workstation that bridges IT and OT networks is harder to spot and more valuable to an intruder than the same implant on a generic office laptop.

The source reporting does not describe any confirmed impact on control systems, PLCs or industrial processes. The documented outcome is remote access to compromised Windows endpoints. The risk to OT is indirect: what an operator does with that foothold if the compromised machine has a route into plant networks.

Indicators of Compromise

Siemens published the following network indicators (defanged):

• 96.62.218[.]59: payload hosting and command-and-control
• wizardexpensive[.]com: payload hosting and command-and-control
• 2.27.248[.]127: distribution channel for AllMyBasic.msi

Siemens also identified a host-level behavioral marker: SiemensSoftwareCenter.exe running from an AppData\Local\Programs path with msiexec.exe as the parent process. A legitimate installation launched by a user or an update mechanism would not normally present that parent and path combination, which makes it a strong signal for this campaign.

Vendor Fix and Mitigation

Siemens addressed CVE-2026-110936 in Siemens Software Center version 4.0.9.8. Per the vendor, the update is applied when the application is started after updating, so a host that has downloaded the fix but never relaunched the application may still be running vulnerable code. Siemens additionally recommends blocking the IP addresses and domain listed above and hunting for the msiexec.exe to SiemensSoftwareCenter.exe execution pattern from AppData\Local\Programs.

RedEye Assessment

This campaign combines three trends that keep producing results for attackers: ClickFix lures that make the victim run the payload, AI assistant abuse as a trusted first touch, and signed vendor binaries used as sideloading carriers. The Siemens patch fixes the immediate flaw, but older signed builds remain usable as carriers for as long as their signatures are trusted. Organizations with Siemens tooling on engineering workstations, or with allowlisting policies that trust industrial vendor signatures by default, should verify whether this chain could execute and go unnoticed in their environment. RedEye Security can assess exposure to the Romulus tradecraft and the published indicators across IT and OT endpoints.