ROMULUS ClickFix platform delivers Legion Loader and other malware
Original title: Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Forescout found six servers; PowerShell staging fetches a trojanized MSI or an archive containing Legion Loader.
Forescout Vedere Labs describes ROMULUS as a ClickFix-style delivery service that uses fake landing pages to persuade users to run malicious commands. Two endpoints serve a PowerShell staging script that chooses either a trojanized MSI carrying a loader or an encrypted archive containing Legion Loader, also called Satacom, CurlyGate, and RobotDropper. The loader then retrieves further payloads from a remote server. Forescout says the operator is unknown and that ROMULUS does not overlap with RomulusLoader or Silver Fox. One related chain used malicious ChatGPT Custom GPTs to send victims to a ClickFix URL.
Unconfirmed: Forescout says it is unknown whether ROMULUS is a private panel, commercial service, affiliate framework, or copied software.
- Six IP addresses were identified running ROMULUS.
- 96.62.224.81 previously hosted a ClickFix script and MSI tied to fake ChatGPT GPTs.
- The same malware was also delivered from 86.109.75.7.
- Legion Loader contacts a remote server to fetch and run additional payloads.
Impact: Users run commands that install loaders and further malware.
- 1.Hunt for suspicious PowerShell commands tied to ClickFix lures.
- 2.Look for DLL sideloading events called out as a detection lead.
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.