Hackers are taking advantage of a critical flaw in the Siemens Software Center, exploiting a vulnerability known as DLL side-loading to execute malware via a trusted application. This issue, identified as CVE-2026-110936, impacts versions prior to 4.0.9.8 of the software.
Siemens Confirms Active Exploitation
Siemens has acknowledged the active exploitation of this flaw and has released a patch to address it. The fix will be automatically applied during the next application startup. A security advisory, SSA-580366, was issued on October 15, with an update on active exploitation added on October 19. Attackers have been observed distributing legitimate Siemens executables alongside malicious files outside of official channels, although Siemens reports no compromises within their systems or update servers.
Understanding the Vulnerability
The flaw lies in how Siemens Software Center handles DLL files, loading them from its directory without proper validation. This oversight allows malicious code to run under the guise of a validly signed application. The attackers have leveraged version 3.5.8.7 of the Siemens Software Center to propagate their malware. Despite retaining a legitimate digital signature, the executable was not altered, but rather accompanied by malicious DLLs exploiting the vulnerability.
This exploit is part of the broader Romulus ClickFix campaign, which deceives users into executing commands through fake prompts. Past incidents have involved hidden PowerShell scripts and altered installers, demonstrating the need for behavioral checks even on signed software.
Indicators and Defense Strategies
Siemens identified two active command-and-control infrastructures: 96.62.218[.]59 and wizardexpensive[.]com, with a third, 2.27.248[.]127, previously distributing malicious content. Users should be vigilant for unexpected appearances of Siemens Software Center in startup applications or Task Scheduler, which could indicate compromise.
Investigators are advised to look for a directory named SM Software Provisioning Service within AppData, unexpected execution of SiemensSoftwareCenter.exe from there, and files like activate.bak or statinfosta.DB alongside the executable. Connections to reported infrastructure should prompt deeper investigation.
It is crucial for users to upgrade to Siemens Software Center 4.0.9.8 or later and ensure downloads are from official sources. Defenders should block the identified infrastructure, review logs for malicious activity, and isolate any compromised systems. Immediate action should be taken to stop malicious processes, remove startup entries, and reset affected passwords.
Lastly, users are reminded not to execute commands from webpages and to treat any command prompts with skepticism. Keeping defenses updated against emerging threats is essential, and incorporating threat intelligence feeds can enhance security measures.
