Ethical Hacking News
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan. A recent attack has highlighted the vulnerability of various systems to exploitation by malicious actors, and emphasizes the importance of keeping systems and applications up to date, as well as the need for robust cybersecurity measures in place.
Malicious actors exploited a flaw in Siemens Software Center to deploy a remote access Trojan (RAT). The vulnerability, tracked as CVE-2026-110936, has a CVSS v4 score of 8.4, indicating high severity. The attackers used DLL sideloading vulnerability to deploy the RAT, which can be used to steal sensitive data and disrupt operations. Siemens Software Center version 4.0.9.8 or later should be updated to mitigate the damage. Organizations are advised to block malicious IP addresses and domains and monitor for suspicious activity. The attack highlights the importance of keeping systems and applications up to date and having robust cybersecurity measures in place.
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
In a recent and concerning development, it has come to light that the malicious actors behind the ClickFix attacks have successfully exploited a flaw in the Siemens Software Center to deploy a remote access Trojan (RAT) on the affected systems. This development has sparked significant concern among cybersecurity professionals and individuals alike, as it highlights the vulnerability of various systems to exploitation by malicious actors.
The Siemens Software Center is a widely used application that provides a range of services and tools to its users. However, in this case, the attackers have successfully identified and exploited a critical flaw in the software center, which allows them to deploy a malicious RAT on the affected systems. The RAT, in turn, can be used to gain unauthorized access to the systems, allowing the attackers to steal sensitive data, disrupt operations, and potentially cause significant harm.
According to the information provided by Siemens, the flaw in the Siemens Software Center is attributed to a DLL sideloading vulnerability, which can be exploited by an authenticated local attacker to place a specially crafted DLL in a directory that the application searches. This, in turn, can lead to arbitrary code execution with the privileges of the affected application. The vulnerability, tracked as CVE-2026-110936, has a CVSS v4 score of 8.4, indicating that it is of high severity and poses a significant risk to the affected systems.
The attackers have been found to be leveraging the "msiexec.exe" to launch "AllMyBasic.msi," which then executes "SiemensSoftwareCenter.exe." The activity has been attributed to a ClickFix delivery platform called Romulus, which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using DLL sideloading.
In addition to the Siemens Software Center, the attackers have also been found to be using malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving a ClickFix lure, which when copied and executed by the victim, runs PowerShell code to drop an MSI installer that abuses DLL sideloading to ultimately deploy a remote access trojan. The remote access trojan, in turn, can be used to gain unauthorized access to the systems, allowing the attackers to steal sensitive data, disrupt operations, and potentially cause significant harm.
Siemens has shared several indicators of compromise, including the IP addresses and domains associated with the malicious activity, as well as specific file paths and directories where the malicious code is deployed. These indicators of compromise provide valuable information to organizations that have been affected by the attack, enabling them to take steps to mitigate the damage and prevent further exploitation.
To mitigate the damage caused by this attack, organizations are advised to update their Siemens Software Center to version 4.0.9.8 or later and start the application to apply the update. They are also advised to block the IP addresses and domains associated with the malicious activity and look for "SiemensSoftwareCenter.exe" running from "AppData\Local\Programs" and started by "msiexec.exe."
Furthermore, the attack highlights the importance of keeping systems and applications up to date, as well as the need for vigilance and awareness among users. It also emphasizes the importance of having robust cybersecurity measures in place, such as intrusion detection systems, antivirus software, and regular backups.
In conclusion, the ClickFix attackers' exploitation of the Siemens Software Center flaw to deploy a remote access Trojan is a concerning development that highlights the vulnerability of various systems to exploitation by malicious actors. It is essential that organizations take proactive steps to mitigate the damage and prevent further exploitation, and that individuals remain vigilant and aware of the potential risks associated with cyber attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/ClickFix-Attackers-Exploit-Siemens-Software-Center-Flaw-to-Deploy-Remote-Access-Trojan-ehn.shtml
https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
https://nvd.nist.gov/vuln/detail/CVE-2026-110936
https://www.cvedetails.com/cve/CVE-2026-110936/
https://www.securityweek.com/clickfix-widely-adopted-by-cybercriminals-apt-groups/
https://cybersecuritynews.com/lazarus-apt-hackers-using-clickfix-technique/
https://cybersecuritynews.com/new-romulus-clickfix-platform/
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://cyberpress.org/oversized-legionloader-evades-scanners/
https://www.netskope.com/blog/new-evasive-campaign-delivers-legionloader-via-fake-captcha-cloudflare-turnstile
Published: Tue Oct 20 02:47:26 2026 by llama3.2 3B Q4_K_M
