Siemens confirmed Software Center is loading the attacker’s DLL. Hunt the folder, not the hash.

ProductCERT validated in-the-wild use of CVE-2026-110936 on 19 October. Attackers shipped a genuine signed Siemens Software Center next to archive.dll. Version 4.0.9.8 fixes the load; it does not remove a copy dropped under AppData.

RWP Ventures · 2026-10-20 · event 2026-10-19 · 15 min read · priority 8.9

Do not collapse five facts.

1. The Siemens file is genuine. Attackers placed their own helper files next to a validly signed copy of Software Center. Version 3.5.8.7, then the latest, loaded those files from its own folder without checking them. Siemens: the program was not modified; the malicious code is in the DLLs the attackers supplied. Hashing SiemensSoftwareCenter.exe will miss this.
2. The CVSS vector is not the delivery. Vendor scores are CVSS v3.1 6.7 (AV:L/AC:L/PR:H/UI:N) and CVSS v4.0 8.4. CWE-427. That describes a local, high-privilege plant-a-DLL. What ProductCERT validated in the wild is a ClickFix drop: the victim pastes a command, an MSI lands, and the signed binary runs from a folder the attacker filled. The victim did not need Software Center already installed.
3. 4.0.9.8 closes the load path. It does not clean AppData. Auto-update applies to existing installations on next start. A copy under %LOCALAPPDATA%\Programs started by msiexec is not that installation. Hunt the folder and the parent process, then isolate.
4. Romulus is a vendor label, not a named crew. Siemens attributes the activity to a Romulus multi-platform ClickFix campaign. Forescout’s 15 October ROMULUS write-up is a delivery panel on six IPs; Forescout could not say who runs it and explicitly separated it from Proofpoint’s RomulusLoader / Silver Fox. The independent overlap in this retrieval is 2.27.248[.]127, which Siemens lists as the now-inactive distribution channel for AllMyBasic.msi and Forescout listed as a ROMULUS host. Huntress’s Custom GPT / Canon / Stardock sideload campaign is related tradecraft, not a Huntress confirmation that Software Center was in those 40 incidents.
5. This is not a PLC event and it is not on KEV. Software Center downloads, installs, and activates Siemens software on a Windows PC. A hit is an endpoint compromise, including on an engineering workstation. It is not confirmed process impact, not SSA-591731, not [Friday’s Patch Tuesday weekly](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/). Catalog freeze is still 2026.10.16 / 1748. CVE-2026-110936 is not a KEV row.

The operator sentence: block the three Siemens indicators, hunt SiemensSoftwareCenter.exe under AppData started by msiexec, and do not treat a current 4.0.9.8 corporate install as proof the ClickFix copy is gone.

What happened

SSA-580366 published 15 October (V1.0) as a DLL search-path bug in all Software Center versions before V4.0.9.8. Jose Oregon of Huntress Labs is credited. V1.1 on 17 October named the fix and the auto-update. V1.2 on 19 October added the exploitation post. That post is the increment.

ProductCERT’s sequence:

• Attackers used a genuine Software Center binary with a valid signature and put their own files beside it.
• They chose it because it is signed and trusted, and because 3.5.8.7 loaded helpers from its own folder.
• No Siemens system, product, or update channel was breached, to Siemens’s knowledge. The bundle did not travel through Siemens distribution.
• EDR vendors and authorities have been engaged for detection sharing.

Siemens IOCs, defanged as published:

Host signs Siemens lists:

• “Siemens Software Center” in Startup or Task Scheduler on a PC that never had it installed
• Folder SM Software Provisioning Service under AppData\Local\Programs (malware-created)
• activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe
• Folder FTSuite containing ftc.uml under AppData\Local
• Connections to 96.62.218[.]59
• SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec

SecurityWeek, 19 October, and The Hacker News, 20 October, independently relay the ProductCERT post. Neither adds a victim census. The Hacker News names archive.dll as the crafted helper; that matches Siemens’s hash table.

Forescout Vedere Labs, 15 October (pre-exploitation notice): ROMULUS is a ClickFix delivery panel. Six IPs exposing the same login: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, 2.27.248[.]127. Two routes in that paper: a trojanized Stardock MSI with DLL sideload, and LegionLoader through padded encrypted archives. Operator identity UNKNOWN. No mention of Software Center.

Huntress, 28 September, updated 14 October: Custom GPTs on chatgpt.com directing users to ClickFix pages; PowerShell; MSI; Canon-signed then Stardock-signed sideload; at least 40 related incidents, two confirmed Custom-GPT-driven. Software Center is not in that write-up. Jose Oregon is in the Huntress acknowledgements and in SSA-580366. Treat that as researcher continuity, not as Huntress counting Siemens drops inside the 40.

Why it matters

Three reasons this is the daily, and why it is not last week’s Siemens Patch Tuesday.

First, a valid Authenticode signature is now the loader. Defenders who allow-list Siemens-signed binaries, or who key EDR on the SSC file hash, will watch the wrong object. Siemens’s own detection sentence is folder and behaviour. That is an operational change on every engineering workstation and every IT admin PC that might run a “Siemens” installer from a browser paste.

Second, the patch story and the infection story are different tickets. V4.0.9.8 stops a vulnerable SSC from loading adjacent DLLs. The in-the-wild package brought its own 3.5.8.7. Launching the corporate, patched Software Center does not delete AllMyBasic.msi residue, the SM Software Provisioning Service tree, the scheduled task, or C2 to 96.62.218[.]59. Isolate first.

Third, this sits on the engineering-workstation path without being a process event. Software Center is how purchased Siemens software is fetched and activated. A RAT or loader on that PC is credential and project-file exposure. It is not a confirmed write to an S7, a Crossbow, or a WinCC server. Do not brief it as AA26-231A or as SSA-591731. Do not skip the hunt because “we don’t run Software Center” — ClickFix does not ask whether you licensed it.

Who / what is affected

Technical context

RWP is not reproducing the sideload. Defenders need the class, the drop path, and the residue.

CVE-2026-110936 is CWE-427 (uncontrolled search path). The affected application loads DLLs from a directory it does not control. Siemens’s in-the-wild description is more specific than the CVE text: helpers loaded from the application’s own folder, on 3.5.8.7, with no check. The public trigger is “start the signed exe next to attacker files.” That is T1574.002 (DLL side-loading) after T1204 / ClickFix user execution and T1218.007 (msiexec).

Do not treat the CVSS PR:H as “only admins.” ClickFix has the user run the installer in their own context. Whatever privilege that user has, the loaded DLL inherits.

Hunt without detonating the MSI:

Forescout’s six ROMULUS IPs are additional hunt inputs for ClickFix staging, not a Siemens IOC table. Do not merge them into “Siemens C2” except where Siemens named the same address (2.27.248[.]127).

ATT&CK mapping for the ticket — public reporting, not a playbook:

Threat / exploitation status

Confidence that Siemens validated in-the-wild sideloading of SSC: high. Confidence that 4.0.9.8 is the close for the load path: high. Confidence that a patched corporate install implies no ClickFix copy on the host: none. Confidence that Romulus, Forescout ROMULUS, and the Huntress Custom-GPT cluster are one operator: low; infrastructure overlap at one IP is moderate as shared delivery, not as attribution. Confidence on process impact: none. Confidence on KEV addition this morning: none — freeze unchanged.

What defenders should do

1. Hunt before you brief “we patched SSC.” EDR / Sysmon: SiemensSoftwareCenter.exe whose image path is under AppData\Local\Programs (or any non-default folder) and whose parent is msiexec.exe. Startup and Task Scheduler names containing Siemens Software Center on PCs that never licensed it. The SM Software Provisioning Service and FTSuite folders above. Isolate a hit, stop the process, remove the autostart, reset credentials used on that host.
2. Detect on folder and behaviour, not on the Siemens fingerprint. Siemens: the file itself is genuine. Blocking SiemensSoftwareCenter.exe by hash or publisher alone will either miss the drop or break licensed updates. Pair publisher allow-lists with path (Program Files vs AppData) and parent process.
3. Block and retrospective-search the Siemens indicators. 96.62.218[.]59, wizardexpensive[.]com, 2.27.248[.]127. The third is inactive for serving files; hosts that fetched AllMyBasic.msi from it before it went dark may still be infected. Add Forescout’s other five ROMULUS IPs as ClickFix staging hunts, labeled as Forescout, not as Siemens C2.
4. Bring licensed Software Center to 4.0.9.8 or later. Start the real install so it auto-updates, or download from Siemens Software Center. Do not fetch “Siemens” installers from a CAPTCHA, a chat prompt, or a Custom GPT. A real “I am not a robot” check never asks for Win+R or PowerShell.
5. Treat a confirmed drop as a workstation incident, including on engineering PCs. Preserve the folder. Rotate credentials and tokens used from that host. Review recent project-file and license-portal access. Do not assume TIA Portal, WinCC, or a PLC was written because SSC was the loader. Escalate to OT IR only on separate evidence of engineering-tool or controller access.
6. Do not wait for a KEV row. Catalog freeze is 2026.10.16 / 1748. BeyondTrust CVE-2026-102764 and Fortinet CVE-2025-61624 were due 19 October; those clocks are on the [16 October Daily Top](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/), not this CVE.
7. Keep the other overnight tickets on their owners. ConnectWise Trust Center 20 October 00:45 UTC: Cloud Backup, SaaS Security, and Cloud Management still suspended, no restoration time, next update by 13:00 UTC today; Entra Free 13 October sign-ins age off today. That is [yesterday’s hunt](/posts/2026-10-19-connectwise-new-ips-log-window/), not a rewrite. OVHcloud CLI: if anyone installed or updated ovhcloud-cli v0.11.0–v0.15.0 between 12:47 and 14:21 UTC on 19 October via the GitHub Releases path, move to immutable v0.16.0 and rotate secrets that sat on disk. That window is real and narrow.

RWP assessment

Score 8.9.

This is a new Siemens exploitation notice, not a rewrite of [16 October weekly OT](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/) (Crossbow, S7 web, Industrial Edge, WinCC). ProductCERT validated wild use, published IOCs, and told defenders the signed file is the wrong object. Evidence quality is high on those vendor statements. Evidence quality is intentionally split on operator identity, victim census, final implant family, and any process consequence.

It outranks the ConnectWise 00:45 UTC still-down update because that update adds no new Application ID, no new IOC, and no restoration time — the material floor remains [19 October](/posts/2026-10-19-connectwise-new-ips-log-window/). Entra Free expiry of 13 October logs is a same-day action already called yesterday. It outranks the OVHcloud CLI GitHub Releases swap (94 minutes, v0.11.0–v0.15.0, secret-stealer, clean immutable v0.16.0) because the confirmed blast radius is people who pulled those five tags in that window, not a signed industrial-software loader that can land on any Windows user who pastes a CAPTCHA. It outranks KEV due-date leftovers (BeyondTrust 102764, Fortinet 61624, due 19 October) because the catalog did not move overnight.

What we are not saying: that Siemens was breached; that 4.0.9.8 remediates a host that already ran the MSI; that Romulus is Silver Fox or a named nation-state; that Huntress’s 40 incidents were Software Center; that a RAT is confirmed as the SSC payload; that a PLC or process was written; that this is on KEV; that ransomware use is Known.

What we are watching

• CISA KEV add for CVE-2026-110936, or a CISA ICS reprint of SSA-580366. Freeze this morning: 2026.10.16 / 1748.
• Whether Huntress, Forescout, or an EDR vendor publishes SSC-specific telemetry (counts, parent processes, follow-on implant).
• Whether 96.62.218[.]59 and wizardexpensive[.]com stay up, and whether new ROMULUS IPs start serving AllMyBasic.msi.
• Engineering-workstation IR that shows TIA / WinCC / controller access after an SSC drop — that would be a new ticket, not this one.
• ConnectWise 13:00 UTC 20 October restoration or publisher-secret rotation.
• OVHcloud post-mortem on the hijacked GitHub account (GlassWorm is researcher attribution, not the vendor’s).

Sources

• Siemens ProductCERT — Active Exploitation of CVE-2026-110936, 19 October 2026
• Siemens ProductCERT — SSA-580366 V1.2
• CVE — CVE-2026-110936
• NVD — CVE-2026-110936
• SecurityWeek — Siemens Software Center exploited in ClickFix attacks, 19 October 2026
• The Hacker News — ClickFix attackers exploit Siemens Software Center, 20 October 2026
• Forescout Vedere Labs — ROMULUS ClickFix delivery platform, 15 October 2026
• Huntress — Custom GPTs deliver RAT via ClickFix, 28 September 2026
• CISA KEV JSON catalog 2026.10.16
• CISA — Known Exploited Vulnerabilities Catalog
• ConnectWise — Trust Center, 20 October 2026 00:45 UTC
• The Hacker News — OVHcloud CLI releases hijacked, 20 October 2026
• Octave Klaba — OVHcloud CLI compromise, 19 October 2026
• [RWP — Weekly OT, 16 October 2026](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/)
• [RWP — ConnectWise new IPs, 19 October 2026](/posts/2026-10-19-connectwise-new-ips-log-window/)
• [RWP — BeyondTrust CVE-2026-102764, 16 October 2026](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/)