ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Forescout found ROMULUS, a reusable ClickFix backend on six servers delivering malware including LegionLoader.
Forescout's Vedere Labs found a hosting panel called ROMULUS while investigating an incident tied to ClickFix activity. Analysts describe it as a reusable multi-payload delivery backend and identified six servers running it, suggesting shared criminal infrastructure. One route delivered LegionLoader in encrypted archives containing an executable inflated to about 842 MiB, likely to evade size-limited scanning. The operator is unknown, and ROMULUS is distinct from Proofpoint's RomulusLoader.
62