Siemens SIMATIC PCS 7 flaw lets attackers run code, install malware

Key Takeaways

• A critical DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center is under active exploitation.
• Attackers are leveraging this flaw to execute arbitrary code and install malware via a signed Siemens executable.
• The vulnerability affects Siemens Software Center versions prior to 4.0.9.8.
• Siemens has released a patch, and affected installations will automatically update upon restart.
• The exploitation is linked to the Romulus multi-platform ClickFix campaign.

Siemens Software Center Flaw Actively Exploited for Malware Delivery

Cybersecurity analysts have identified active exploitation of a critical DLL side-loading vulnerability within the Siemens Software Center, designated as CVE-2026-110936. This flaw enables attackers to execute malicious code and install malware by leveraging a trusted, digitally signed Siemens application.

The vulnerability impacts all versions of Siemens Software Center preceding 4.0.9.8. Siemens has acknowledged the ongoing exploitation and promptly issued a corrective update. Existing installations are designed to automatically apply this patch the next time the application is launched.

Exploitation Details and Attack Vector

Siemens released security advisory SSA-580366 on October 15, subsequently updating it on October 19 to confirm active exploitation. According to Siemens’ internal campaign analysis, threat actors are distributing a legitimate Siemens executable, bundled with malicious files, through unofficial channels.

Crucially, Siemens has stated that its own systems, products, and official update infrastructure remain uncompromised. The attackers are specifically utilizing Siemens Software Center version 3.5.8.7 as their primary delivery mechanism for malware.

The core of the attack lies in a DLL side-loading technique. Attackers are not modifying the genuine Siemens executable, which retains its valid digital signature. Instead, they strategically place malicious DLL files alongside it. The vulnerable application then, due to an uncontrolled search path, inadvertently loads these untrusted libraries from its local directory without proper validation. This allows the malicious code to execute with the same elevated privileges as the legitimate Siemens application.

According to Siemens, this method highlights why merely checking the digital signature of the main executable is insufficient for security. Defenders who only verify the integrity of SiemensSoftwareCenter.exe could easily overlook the co-located malicious DLLs responsible for the infection.

Link to Romulus ClickFix Campaign

The current malicious activity is associated with the Romulus multi-platform ClickFix campaign. This campaign typically employs social engineering tactics, luring users into executing commands via deceptive “fake verification” or “repair” prompts. Past instances of the ROMULUS ClickFix platform have involved hidden PowerShell scripts, manipulated installers, and the loading of malicious libraries through otherwise legitimate software.

Previous ClickFix attacks have also utilized Python tunnels, combining trusted executables with adjacent malicious DLLs and scheduled tasks to form complex infection chains. These patterns underscore the critical need for behavioral analysis in addition to signature-based checks, even for signed software.

Indicators of Compromise (IoCs) and Mitigation

Siemens has identified specific infrastructure used in the attacks. The IP address 96.62.218[.]59 and the domain wizardexpensive[.]com are active as both payload hosting and command-and-control (C2) servers. Another IP address, 2.27.248[.]127, was previously involved in distributing the malicious AllMyBasic.msi bundle, though it is no longer active.

Warning signs of potential compromise include the unexpected appearance of Siemens Software Center in startup applications or Task Scheduler on systems where it was not intentionally installed by the user. Investigators should also look for the presence of a folder named SM Software Provisioning Service within %LOCALAPPDATA%Programs, especially if SiemensSoftwareCenter.exe is being launched from this location by msiexec.

Additional indicators include files like activate.bak or statinfosta.DB found alongside the executable, or an FTSuite folder containing ftc.uml under %LOCALAPPDATA%. Any network connections to the identified malicious infrastructure should be treated as highly suspicious and investigated immediately.

Indicators of Compromise

What You Should Do

• Update Immediately: Ensure all installations of Siemens Software Center are updated to version 4.0.9.8 or later. Simply restarting existing installations should trigger the automatic update process.
• Source Software Officially: Always download Siemens Software Center from the official Siemens website, avoiding third-party bundles or unofficial sources.
• Block Malicious Infrastructure: Implement blocks for the identified IP addresses (96.62.218[.]59, 2.27.248[.]127) and domain (wizardexpensive[.]com) at your network perimeter.
• Review Logs: Conduct a thorough review of historical network and system logs for any connections to the listed indicators of compromise or suspicious process activity.
• Isolate and Remediate: If a system shows signs of compromise, immediately isolate it from the network. Stop any malicious processes, remove unexpected startup entries or scheduled tasks, and follow your organization’s incident response procedures, including resetting affected user credentials.
• Educate Users: Remind users never to paste commands from webpages directly into “Run” dialogs or PowerShell. Genuine “I am not a robot” checks do not require local command execution.
• Monitor for Anomalies: Continuously monitor for unexpected appearances of Siemens Software Center in startup programs or Task Scheduler, especially if users did not explicitly install it.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.