Siemens Software Center Flaw Exploited in ClickFix Attacks to Deploy RAT

Vulnerability Patched in Siemens Software Center

Siemens has released an update for its Software Center, addressing a high-severity DLL sideloading vulnerability identified as CVE-2026-110936 (CVSS v4 score: 8.4). The flaw allowed an attacker to place a specially crafted DLL in a directory searched by the application, leading to the execution of malicious code with the same privileges as the affected service. The issue has been resolved in version 4.0.9.8 of the Siemens Software Center.

Exploitation in ClickFix Attacks

Attackers have exploited this vulnerability in what are termed 'ClickFix attacks'. They abused a legitimate, signed copy of Siemens Software Center by placing a malicious DLL, 'archive.dll', alongside it. This method leveraged the application's trust and its behavior of loading helper files from its own folder without validation in older versions, specifically 3.5.8.7.

Attack Chain and Malware Deployment

The attack chain involved using 'msiexec.exe' to launch 'AllMyBasic.msi', which then executed 'SiemensSoftwareCenter.exe'. This activity is linked to the Romulus ClickFix delivery platform, known for deploying malware like Legion Loader via DLL sideloading. Some campaigns also utilized malicious ChatGPT Custom GPTs to direct victims to fake URLs, which then delivered a ClickFix lure that dropped an MSI installer to deploy a remote access trojan.

Mitigation and Indicators of Compromise

Siemens advises users to update their Software Center to version 4.0.9.8 or later. Additionally, organizations should block identified indicators of compromise, including IP addresses 96.62.218[.]59, 2.27.248[.]127, and the domain wizardexpensive[.]com, which are associated with payload hosting, command-and-control, and distribution channels for the malicious activity.