Hackers Actively Exploiting Siemens Software Center Flaw in ClickFix Malware Attacks

Hackers are exploiting a DLL side-loading flaw in Siemens Software Center to run malware through a trusted, signed application. Tracked as CVE-2026-110936, the weakness affects versions before 4.0.9.8.

Siemens has confirmed active exploitation and released a fix, and existing installations will receive the update the next time the application starts.

Siemens published security advisory SSA-580366 on October 15 and added a reference to active exploitation on October 19. According to the company’s campaign details, attackers distributed a genuine Siemens executable alongside malicious files outside official channels.

Siemens said it was unaware of any breach involving its systems, products, or update channel. The attackers used Siemens Software Center version 3.5.8.7 to deliver their malware.

The executable retained its valid digital signature and was not modified. Instead, attackers placed malicious DLL files beside it, exploiting how the vulnerable application searched for supporting libraries.

Siemens Software Center Flaw Exploited

According to Siemens, DLL side-loading occurs when an application loads an untrusted library from its folder without proper validation, allowing malicious code to execute with the application’s privileges due to an uncontrolled search path.

This makes the executable’s location and behavior important. A valid signature on SiemensSoftwareCenter.exe does not establish that neighboring DLLs are safe. Defenders who check only the genuine executable’s fingerprint could miss the files responsible for the infection.

The activity is linked to the Romulus multi-platform ClickFix campaign. ClickFix tricks users into running commands through fake verification or repair prompts.

Previous reporting on the ROMULUS ClickFix platform described hidden PowerShell scripts, modified installers, and malicious libraries loaded through legitimate software.

Cyber Security News has also covered ClickFix attacks using Python tunnels, where trusted executables, nearby malicious DLLs, and scheduled tasks formed part of the infection chain. These cases show why signed software still requires behavioral checks.

Siemens identified 96.62.218[.]59 and wizardexpensive[.]com as payload-hosting and command-and-control infrastructure. Both were active when its campaign notice was published.

Another address, 2.27.248[.]127, previously distributed the malicious AllMyBasic.msi bundle but was no longer serving files. Earlier downloads still require investigation.

Warning signs include Siemens Software Center appearing in startup apps or Task Scheduler on computers where users never installed it.

Indicators of Compromise

Investigators should check for a folder named SM Software Provisioning Service under AppData\Local\Programs and unexpected execution of SiemensSoftwareCenter.exe from that location, particularly when launched by msiexec.

Other reported traces include activate.bak or statinfosta.DB beside the executable and an FTSuite folder containing ftc. uml under AppData\Local. Connections to the reported infrastructure should trigger further investigation rather than being treated as harmless software-update traffic.

Users should install Siemens Software Center 4.0.9.8 or later. Starting an existing installation triggers its automatic update. Downloads should come from the official Siemens Software Center page, not third-party bundles.

Defenders should block the listed infrastructure, review historical logs, and isolate compromised systems. Stop the malicious process, remove startup entries and scheduled tasks, then reset affected passwords through the incident response process.

Users should never paste commands from webpages into Run or PowerShell. A genuine “I am not a robot” check does not require running a command on the computer.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.