What happened

• Siemens Software Center has a DLL sideloading flaw tracked as CVE-2026-110936 [S1][S2].
• Attackers are reported to exploit it in ClickFix social-engineering attacks tied to the ROMULUS delivery platform [S1][S2].
• The reported payload is a remote access trojan [S1][S2].
• The reported chain is msiexec.exe launching SiemensSoftwareCenter.exe, which then loads an attacker-supplied DLL [S1][S2].
• Siemens Software Center 4.0.9.8 or later fixes the flaw [S1][S2].

Timeline

Detect

SiemensSoftwareCenter.exe spawned by msiexec.exe · Sysmon EID 1 / Windows Security 4688 / EDR process events

index=* (EventCode=1 OR EventCode=4688) | eval child=coalesce(Image,NewProcessName), parent=coalesce(ParentImage,ParentProcessName) | search child="*\\SiemensSoftwareCenter.exe" parent="*\\msiexec.exe" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmd by host, User, child, parent

A hit means: The process chain the sources describe for the sideloading attack. Treat it as suspect until the MSI is confirmed as a legitimate Siemens installer from a managed deployment [S1][S2].

DLLs loaded by SiemensSoftwareCenter.exe from unsigned or user-writable paths · Sysmon EID 7 (image load) / EDR module-load events

index=* EventCode=7 Image="*\\SiemensSoftwareCenter.exe" (Signed="false" OR ImageLoaded="*\\Users\\*" OR ImageLoaded="*\\AppData\\*" OR ImageLoaded="*\\Temp\\*" OR ImageLoaded="*\\ProgramData\\*") | stats count min(_time) as first_seen values(Signature) as signer values(Hashes) as hashes by host, Image, ImageLoaded

A hit means: A possible sideloaded DLL, which is the reported exploitation step [S1][S2]. Collect the DLL and its hash for analysis.

msiexec.exe started from Explorer with a remote package (ClickFix pattern, inferred) · Sysmon EID 1 / Windows Security 4688 / EDR process events

index=* (EventCode=1 OR EventCode=4688) | eval child=coalesce(Image,NewProcessName), parent=coalesce(ParentImage,ParentProcessName) | search child="*\\msiexec.exe" parent="*\\explorer.exe" (CommandLine="*http://*" OR CommandLine="*https://*") | stats count min(_time) as first_seen values(CommandLine) as cmd by host, User, parent, child

A hit means: A user may have pasted a command that installs a remote MSI, a common ClickFix step. The sources do not give the exact command, so this hunt is inferred and broad. Tie a hit to the Siemens chain before escalating [S1][S2].

Verify

• Confirm the parent MSI: get its path, hash, signer and download origin, then compare with the official Siemens installer.
• Check the signer, path and hash of each DLL that SiemensSoftwareCenter.exe loaded. A DLL beside the executable in a user-writable folder is the strongest sign.
• Look for network connections from the process tree after launch, which would fit RAT activity.
• Benign look-alike: a legitimate Siemens Software Center install or update through msiexec. Expect a managed deployment parent such as SCCM/Intune agents or SYSTEM context, a signed Siemens MSI, and only signed DLLs.
• Benign look-alike for hunt 3: IT scripts or users installing vendor MSIs from internal web servers.

Scope

Affected

• Siemens Software Center versions earlier than 4.0.9.8 [S1][S2]

Only if

None stated by the sources.

Not affected if

• Siemens Software Center is at 4.0.9.8 or later [S1][S2]

Fixed in: Siemens Software Center 4.0.9.8 [S1][S2]

Enumerate

• Endpoints with Siemens Software Center installed, and their versions (software inventory, EDR file and installer records)
• Hosts where SiemensSoftwareCenter.exe ran from paths other than its standard install directory
• Users on hosts with hits from hunts 1–3, and the credentials and sessions available on those hosts
• Outbound destinations contacted by affected process trees

Contain

• Network-isolate hosts with confirmed hits through EDR. Capture memory and collect the MSI, sideloaded DLL and process tree first.
• Block hashes of malicious MSIs and DLLs, and any confirmed C2 destinations, at the EDR, proxy and DNS layers.
• Update or remove Siemens Software Center versions earlier than 4.0.9.8 on all hosts.
• Reset credentials and revoke sessions for users of compromised hosts. This cannot be undone and disrupts users, so scope it to confirmed hosts.
• Reimaging destroys on-disk evidence and cannot be undone. Finish collection before you do it.

Eradicate

• Remove the sideloaded DLL and the malicious MSI from affected hosts [S1][S2].
• Remove the RAT and its persistence. The sources do not describe the persistence, so reimage confirmed hosts rather than clean them.
• Fix the root cause by updating Siemens Software Center to 4.0.9.8 or later [S1][S2].

Recover

• Before restoring a host, confirm Siemens Software Center is at 4.0.9.8+ or removed, and that no unsigned DLLs remain beside the executable.
• Restore only reimaged hosts to the network, and only after credential resets are complete.
• Keep hunts 1–3 running for at least 30 days and watch for repeat ClickFix-style msiexec launches by the same users.

Re-enter the loop when

• Siemens publishes an advisory that changes the affected versions, the fixed version, or mitigations.
• CISA KEV or a vendor publishes IoCs for the ROMULUS platform or the RAT (hashes, domains, DLL names).
• Another signed application is reported abused in the same ClickFix/ROMULUS chain.
• A hit appears on a host with no Siemens Software Center install, which would mean the binary was brought in by the attacker.

Debrief

• Record the MSI origin, the lure (page or message), the DLL name and hash, and the RAT C2 for each confirmed host.
• Record how many installs existed, and whether the product is approved software.
• Gap: the sources gave no technical detail. DLL name, RAT family, IoCs and persistence are unknown.
• Gap: no Siemens advisory or CISA KEV entry was reviewed. The KEV status comes from pipeline metadata.

Detection coverage — checked automatically

Checked automatically 2026-11-03 23:31Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-110936

cpe:"cpe:/a:siemens:software_center"

product:"Software Center"

host.services: (software.product = "Software Center")

Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 0 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-03 23:31Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Has Siemens published an advisory, and does it confirm the affected range and 4.0.9.8 as the fix?
• Is CVE-2026-110936 actually in CISA KEV, and on what date was it added?
• What DLL name is sideloaded, and what RAT family is deployed?
• Are there published IoCs for the ROMULUS delivery platform?
• Did the attackers bring their own copy of SiemensSoftwareCenter.exe (BYOV-style), or do they target existing installs? The answer changes scope.

Sources

• [S1] https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html · The Hacker News
• [S2] https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ · SecurityWeek

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.