LegionLoader (Malware): news timeline & CVEs

Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

Forescout says ROMULUS delivers LegionLoader and sideloaded malware through ClickFix traps.

Forescout's Vedere Labs identified ROMULUS, a reusable backend that delivers malware through ClickFix lures using concealed PowerShell and malicious MSI installers. One chain silently installed a package posing as Stardock's Smart DeElevation Tool and used DLL sideloading; another used 7-Zip and nested encrypted archives to load LegionLoader. LegionLoader registered infected systems, executed PowerShell, fetched payloads, and accessed Chrome Local State material, with command traffic using RC4 and Base64. Researchers linked earlier activity to ChatGPT Custom GPT lures documented by Huntress but found no evidence tying ROMULUS to RomulusLoader.

Cyber Security NewsOct 16, 14:42 UTC · 11h agoMalware in the wild 4 sources2· 1 read

ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads

Forescout found ROMULUS, a reusable ClickFix backend on six servers delivering malware including LegionLoader.

Forescout's Vedere Labs found a hosting panel called ROMULUS while investigating an incident tied to ClickFix activity. Analysts describe it as a reusable multi-payload delivery backend and identified six servers running it, suggesting shared criminal infrastructure. One route delivered LegionLoader in encrypted archives containing an executable inflated to about 842 MiB, likely to evade size-limited scanning. The operator is unknown, and ROMULUS is distinct from Proofpoint's RomulusLoader.

Infosecurity Magazineupdated Oct 16, 14:42 UTC · 11h agofirst Oct 14, 14:00 UTC · 2d agoMalware in the wild 4 sources1

LegionLoader

Timeline2 articles

Appears with

Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads