Siemens said Monday that attackers have exploited a flaw in Siemens Software Center, the program its customers use to get and update Siemens software, by planting malware beside a genuine, digitally signed copy of the app. The case, also reported by SecurityWeek, shows how a trusted vendor’s code can be turned into a delivery vehicle without the vendor itself being hacked, and why a valid signature is not proof that what runs on a machine is safe.
What Happened
The flaw, tracked as CVE-2026-110936, is a DLL side-loading weakness. Windows programs load helper files called dynamic-link libraries (DLLs) as they run; side-loading tricks a legitimate program into loading an attacker’s file instead. Siemens advisory SSA-580366 says the app searched for DLLs in places it did not control, so an attacker who plants a crafted file can run code with the app’s privileges. It is rated 8.4 out of 10 under version 4 of the Common Vulnerability Scoring System and 6.7 under version 3.1. The advisory was first published Oct. 15, a fix was added Oct. 17 and a pointer to the exploitation report followed Oct. 19. It credits Jose Oregon of Huntress Labs with reporting the flaw.
In its exploitation notice, Siemens said attackers placed malicious DLLs, including one named archive.dll, next to an unmodified, validly signed copy of version 3.5.8.7, which loaded them without checking. The package, an installer called AllMyBasic.msi, was distributed from a server outside Siemens channels that is now inactive. “No Siemens system, product or update channel was breached to our knowledge,” the company wrote.
Siemens tied the activity to what it called the Romulus multi-platform ClickFix campaign. ClickFix lures persuade people to copy commands from a web page and paste them into the Windows Run box or PowerShell, which then runs the attacker’s code. Siemens said it is sharing intelligence with authorities and endpoint security vendors.
Why It Matters
Many security tools and allow-lists extend extra trust to software signed by established vendors, and blocklists often match files by their hash, a digital fingerprint. Neither helps here: the Siemens executable is the real one. That is why Siemens urged detection based on where the program is running and how it behaves.
For boards, the lesson reaches beyond Siemens customers. Any signed program with a similar weakness can be repurposed this way, so an organization’s exposure depends partly on how its vendors build software, not only on whether those vendors are breached.
Context
SecurityWeek reported that Forescout published research the previous week on Romulus, a ClickFix delivery platform it found on several servers, including the one Siemens identified as distributing the malicious package. Forescout could not determine who operates it. In late September, Huntress described a campaign that abused signed Canon and Stardock programs in the same way and was linked to at least 40 incidents, The Primary Wire reported at the time, citing SecurityWeek and Help Net Security. SecurityWeek said the overlapping infrastructure and method suggest the Siemens program may have joined the same toolkit, though neither Huntress nor Forescout mentioned it.
What to Watch
- Siemens says existing installations update to the fixed version 4.0.9.8 the next time they start, so machines that seldom open the app may need attention.
- Siemens advises blocking its published IP address and domain, searching logs for Software Center running from a user’s AppData\Local\Programs folder after being launched by the Windows installer, and looking for startup entries on PCs that never had the software. If compromise is suspected, it says to isolate the machine, stop the process, remove the startup entries and reset passwords.
- Whether CISA adds the flaw to its Known Exploited Vulnerabilities catalog; none of the coverage so far mentions a listing.
- Whether researchers link Romulus to a specific operator or find other signed programs in its toolkit.
