New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
4
Stories per day · 30 days
3 RSS
Relatedclickfix5dll-sideloading4legionloader3romulus3malware-delivery2powershell2python-tunnel2axolotl-loader1axolotlloader1customer-success1cybersecurity1horizon31leadership1loader1lorem-ipsum1lorem-ipsum-loader1nodezero1rhysida1
10 stories, newest first · one card per story
Stories tagged #forescout
Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Forescout says ROMULUS delivers LegionLoader and sideloaded malware through ClickFix traps.
Horizon3 Promotes Ellen Sundra to Chief Customer Officer to Advance Customer Success and Security Outcomes
Horizon3 promoted Ellen Sundra to Chief Customer Officer to scale NodeZero customer success.
Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.
3
New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
5
ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Forescout found ROMULUS, a reusable ClickFix backend on six servers delivering malware including LegionLoader.
Medical devices patients rely on most are least prepared for quantum attacks
Forescout found only 6% of medical devices support PQC-capable SSH, and 5,500 healthcare systems are exposed.
1
Only 13% of OT Network Segments Are Fully Isolated: Analysis
Forescout finds only 13% of OT-containing network segments are fully isolated across 209 organizations.
Network Segmentation Failures Are Expanding the Corporate Attack Surface
Forescout finds nearly half of OT and medical segments also hold IT or IoT, widening lateral movement.
1
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.