Oct 21, 2026

Tags:

Signed Is Not Safe: The Siemens Software Center ClickFix Lesson for Engineering Laptops

Quick question, amigos. If you opened Task Manager on your engineering laptop right now and saw a Siemens process running, would you even blink?

Probably not. And that’s exactly what attackers are counting on.

On October 19, Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center. The twist is that nobody broke into Siemens. The attackers brought their own genuine, validly signed copy of the program and set it up to run their code.

What actually happened

Siemens Software Center is the install manager Siemens uses to download, install and activate purchased software. Think NX, Solid Edge, Simcenter and Teamcenter X. That’s CAD, simulation and PLM, not PLC programming tools.

Here’s the trick, explained without the recipe. Version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them. So the attackers packaged that real, signed program in a malicious installer, put their own DLL files next to it, and distributed the bundle outside Siemens channels.

Siemens put it plainly: “The Siemens program was not modified. The malicious code is in the DLL files the attackers supplied.”

To your security tools, it looks like a legit Siemens app starting up. It’s camouflage with a real signature.

Siemens ties the distribution to the “Romulus multi-platform ClickFix campaign.” ClickFix is the fake CAPTCHA or fake error page that talks you into pasting a command into the Run box or PowerShell. Forescout described Romulus on October 15 as a new multi-payload ClickFix delivery platform.

The timeline

Oct 15: Siemens publishes SSA-580366.
Oct 17: The fix lands in version 4.0.9.8.
Oct 19: Siemens confirms exploitation in the wild, and the Canadian Centre for Cyber Security repeats it.

Scores: 6.7 on CVSS v3.1 and 8.4 on CVSS v4.0. Same bug, different scales, so don’t let the headlines confuse you.

As of my check on October 20, it’s not in CISA’s KEV catalog, and there’s no CISA ICS advisory for it.

What we don’t know

Mira, let’s be honest about the gaps.

Nobody knows who runs Romulus. Forescout says the operator’s identity is unknown, and it could be a private panel, a criminal delivery service, an affiliate setup, or software copied between crews. It’s also not the same thing as the “RomulusLoader” name you might have seen elsewhere. Forescout says they have no evidence the two are related.

Siemens hasn’t named the final payload for this wave or the exact lure. There are no published victim counts, no named actor, and no evidence that industrial users were specifically targeted. No source reports any PLC, OT network or industrial process compromise.

So no, this isn’t a PLC story. It’s an engineering laptop story.

Why patching alone won’t save you

This is the part I really want you to sit with.

Siemens says existing installs auto-update on next startup. Good. But think about what that means:

The program has to actually be launched.
The install needs internet access and a Siemens account.
Offline or air-gapped engineering stations won’t update themselves. Someone has to do it manually, using installers checked against the SHA-256 checksums Siemens publishes.

And the big one: updating your copy does nothing about the old signed copy an attacker drops on the machine. They bring version 3.5.8.7 with them. Your patch can’t recall it.

That’s why detection comes first here. Siemens lists a great warning sign: “Siemens Software Center” showing up in start-up apps or Task Scheduler on a PC that never had it installed. Siemens also says to look for the program running from the user’s AppData\Local\Programs folder, launched by the Windows installer, msiexec.

Siemens’ advice in its own words: “Detect on folder and behaviour, not on the Siemens file fingerprint: the file itself is genuine.” Don’t hash-block the Siemens executable. Grab the real indicators from the Siemens page linked below.

Why OT folks should care anyway

Picture the engineering laptop you find at a lot of small manufacturers and integrators.

One Windows machine. CAD tools on it. PLC and HMI programming software on it. VPN clients to three customer sites. Saved project files. Maybe some passwords in the browser. That laptop is the house keys, the car keys and the garage opener hanging on one hook by the front door.

Malware on that box doesn’t need a PLC exploit. It just needs what the engineer can already reach. Credential theft and remote access from there is the realistic path to OT.

And engineers install vendor tools and run admin commands all day. A Siemens process at start-up looks normal. That’s why a trusted industrial brand makes such good cover.

If you found a hit, follow Siemens’ order: isolate the PC, stop the process, remove the start-up entry and scheduled task, then reset passwords. Por favor include the VPN and remote access credentials that lived on that machine.

Bottom line

Attackers borrowed a trusted industrial brand to hide a commodity ClickFix chain. The OT lesson isn’t a PLC bug. Engineering laptops are high-value hosts, and a vendor patch can’t pull back old signed copies already in criminal hands.

Hunt first. Look for Software Center where it was never installed, especially in AppData, and for msiexec as its parent.
Update every real install to 4.0.9.8, including the offline stations nobody launches.
Kill the ClickFix habit. No CAPTCHA, chatbot or fix page will ever ask you to paste a command. Restrict Run and PowerShell where people don’t need them.

Stay sharp, familia.

Javier