Cybersecurity experts have revealed information about a ClickFix delivery system named ROMULUS that is being utilized to spread malware, including Legion Loader.
As reported by Forescout Research – Vedere Labs, ROMULUS functions similarly to a malware distribution service, using ClickFix-style bait on fraudulent landing pages to deceive unsuspecting individuals into executing harmful commands that compromise their devices.
Security analyst Sai Molige noted in an evaluation that “ROMULUS could be a privately managed panel, a commercial cybercriminal distribution service, an affiliate network, or software that has been replicated among different operators.”
The cybersecurity firm has pinpointed six IP addresses associated with ROMULUS:
- 96.62.224[.]81
- 86.109.75[.]7
- 151.240.151[.]223
- 23.94.145[.]224
- 93.152.224[.]118
- 2.27.248[.]127
Significantly, the IP address “96.62.224[.]81” was found to host a ClickFix script along with an MSI installer file linked to another campaign that has been discovered using malicious ChatGPT Custom GPTs to lead victims to a fraudulent URL that serves the ClickFix lure.
Forescout’s analysis has also revealed the same malware being distributed through another server, 86.109.75[.]7, which also hosted a panel referred to as ROMULUS. Furthermore, a different chain initiated via ClickFix has been employed to execute a PowerShell script that subsequently delivers Legion Loader, which is also known as Satacom downloader, CurlyGate, and RobotDropper.
At the time of writing, the identity of those behind the ROMULUS platform remains unknown. However, it does not share any connections with RomulusLoader, a malware family linked to Silver Fox (also known as TA4922), a threat actor aligned with China that is recognized for frequently using tax-related justifications to distribute remote access trojans such as ValleyRAT (also known as Winos 4.0), DcRAT, and potentially Venom RAT through DLL sideloading methods.
The ROMULUS platform reveals two endpoints intended to download a PowerShell staging script, which determines the next payload to be retrieved: either a trojanized MSI installer containing a malware loader or an encrypted archive with Legion Loader that is inflated to nearly 1 GB with repetitive padding to evade upload restrictions, sandbox budgets, or static-analysis thresholds. The loader, in turn, interacts with a remote server to obtain and execute additional payloads.
The findings illustrate how ClickFix is advancing from a mere social engineering tactic to a highly effective entry point for malware. To counter this threat, it is crucial to monitor for suspicious PowerShell commands and DLL sideloading activities.
Source: Original article
