Cybersecurity experts have revealed a new threat in the form of the ROMULUS ClickFix platform, which is being utilized to spread malicious software, including Legion Loader. This discovery sheds light on how cybercriminals are evolving their tactics to deploy malware more effectively.
Understanding the ROMULUS Platform
According to research conducted by Forescout Research – Vedere Labs, ROMULUS operates as a malware distribution service. It uses ClickFix-style bait on fake landing pages to deceive users into executing harmful commands, thereby compromising their systems. The nature of ROMULUS remains somewhat ambiguous, with possibilities ranging from a privately run panel to a commercial cybercriminal service.
Technical Analysis and IP Addresses
The cybersecurity team identified six IP addresses linked to ROMULUS. Among these, IP ‘96.62.224[.]81’ was found hosting a ClickFix script, which, in combination with an MSI installer file, was used in another campaign involving malicious ChatGPT Custom GPTs. Another server, ‘86.109.75[.]7’, was also implicated in distributing the same malware, highlighting the coordinated nature of these attacks.
Malware Distribution and Techniques
The ROMULUS platform is known for exploiting two specific endpoints to download a PowerShell staging script. This script decides whether to deploy a trojanized MSI installer or an encrypted archive containing Legion Loader. The loader then communicates with a remote server to obtain and execute further malicious payloads.
Interestingly, despite sharing a name, ROMULUS is not related to RomulusLoader, which is linked to the China-aligned threat actor known as Silver Fox. This actor is recognized for using tax-related themes to spread remote access trojans.
Implications and Prevention
The use of ClickFix in the ROMULUS platform illustrates how social engineering tactics are being enhanced as entry points for malware. To counteract these threats, it is crucial for organizations to monitor for unusual PowerShell activities and DLL sideloading occurrences. Understanding these vectors can significantly aid in mitigating potential cyber threats.
The evolving nature of platforms like ROMULUS underscores the importance of staying informed about the latest cybersecurity developments to protect against sophisticated malware threats.
