Siemens Software Center DLL Side-Loading Flaw Used to Deliver Malware

Attackers are exploiting a DLL side-loading vulnerability in Siemens Software Center to run malware through a legitimately signed Siemens executable. The issue is tracked as CVE-2026-110936 and affects Siemens Software Center versions earlier than 4.0.9.8.

Siemens has confirmed active exploitation, published a security advisory (SSA-580366) and released a fix. Existing installations will receive the update the next time the application is started.

How the attack worked

According to Siemens, attackers distributed a genuine, digitally signed Siemens executable alongside malicious files outside official channels. The executable itself was not modified and retained its valid signature. Instead, the attackers placed malicious DLL files in the same folder as the signed executable and relied on the application’s uncontrolled search path for supporting libraries.

DLL side-loading occurs when an application loads a library from its folder without properly validating it, allowing an attacker-supplied DLL to execute with the application’s privileges. A valid signature on SiemensSoftwareCenter.exe does not guarantee that neighboring DLLs are safe, so checks that validate only the executable’s fingerprint can miss the files responsible for the compromise.

Siemens said it has no indication the company’s own systems, products or update channel were breached. The attackers used Siemens Software Center version 3.5.8.7 to deliver their malware.

Campaign context

Siemens links the activity to the Romulus multi-platform ClickFix campaign. ClickFix social-engineering techniques trick victims into executing commands via fake verification or repair prompts. Previous reporting on Romulus and ClickFix has described hidden PowerShell scripts, modified installers, malicious libraries loaded through legitimate software, and use of Python tunnels. Those cases illustrate why signed software must still be monitored for suspicious behavior.

Infrastructure and artifacts

At the time of Siemens’ advisory, the company identified 96.62.218[.]59 and wizardexpensive[.]com as active payload-hosting and command-and-control infrastructure. Another address, 2.27.248[.]127, previously distributed a malicious installer bundle named AllMyBasic.msi but was no longer serving files; earlier downloads from that host still require investigation.

Indicators of compromise

Investigators should check for an SM Software Provisioning Service folder under %AppData%LocalPrograms and look for unexpected execution of SiemensSoftwareCenter.exe from that location, especially when launched by msiexec. Other traces include the presence of activate.bak or statinfosta.DB beside the executable and an FTSuite folder containing ftc.uml under %AppData%Local. Connections to the reported infrastructure should be investigated and not assumed to be benign software-update traffic.

Recommendations

Users should install Siemens Software Center version 4.0.9.8 or later. Starting an existing installation will trigger the automatic update. Downloads must come from the official Siemens Software Center page, not third-party bundles.

Defenders should block the listed IPs and domain, review historical logs for related activity, and isolate any compromised systems. Follow incident response procedures: stop malicious processes, remove unwanted startup entries and scheduled tasks, clean or restore affected hosts, and reset credentials that may have been exposed.

Users should never paste commands from web pages into Run or PowerShell — a legitimate “I am not a robot” or similar check should not require running commands on your machine.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with operational data to accelerate detection and response.