INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

JemenSSofteware Center Hacked by Akyong, Jeongsang Group

| 2026-10-21 00:08 LOW LOW DATA BREACH
JSON
Executive Summary
AI-generated
A security vulnerability in Siemens' software management program, identified as CVE-2026-110936, was being exploited in actual attacks starting on October 19th. The attackers combined the digital signature program with malicious files to use a method called 'DLL side-loading', allowing them to run malicious code on user computers without tampering with the legitimate program itself. This vulnerability affects Siemens Software Center and has been linked to a ClickFix social engineering attack campaign, Romulus, which is also being used by other companies such as Canon and StarDoc. The attackers have published various malicious codes using this infrastructure, including 40 related attacks that were responded to by ForeScout. A patch version [IOC HIDDEN • LOGIN REQUIRED] has been released to fix the vulnerability, automatically applying the update when run by existing users.
Technical Mitigations AI-generated
• Patch Siemens Software Center to version <a href="/auth/login?next=/detail/hjr1XaEBDYL3N98kWrxD" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> (CVE-2026-110936) to fix the vulnerability. • Block or hunt for malicious DLLs in the same folder as officially signed executable files, and monitor suspicious DLL loading. • Use digital signatures, hash values, actual execution locations, and behavioral analysis to detect the malicious Jimiens program. • Monitor abnormal program execution paths and investigate registration of automatic execution.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ar•••••.dll
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-110936CVE-2026-110936
Target & Sectors
Global Scope
Incident Timeline
‎October 19th
Threat actors exploited the previously disclosed vulnerability in Siemens Software Center (CVE-2026-110936) on October 19th.
vulnerability CVE-2026-110936
Siemens announced on October 19th that the vulnerability in its 'Siemens Software Center' (CVE-2026-110936) was being exploited in actual attacks.
‎2026/10/21
Attackers exploited a security vulnerability in Siemens' software management program, releasing malicious code that was automatically applied to existing users when they ran the program.
infrastructure Windows
ClickFix is a social engineering attack that shows the user a fake CAPTCHA authentication or system error solution screen and prompts the user to copy and input specific commands directly into the Windows command prompt or PowerShell.
organisation CAPTCHA
ClickFix is a social engineering attack that shows the user a fake CAPTCHA authentication or system error solution screen and prompts the user to copy and input specific commands directly into the Windows command prompt or PowerShell.
infrastructure 8.4
The vulnerability was evaluated at 8.4 points on the CVSS 4.0 scale and a version 4.0.9.8 was released to fix it.
infrastructure 4.0
The vulnerability was evaluated at 8.4 points on the CVSS 4.0 scale and a version 4.0.9.8 was released to fix it.
infrastructure 4.0.9
The vulnerability was evaluated at 8.4 points on the CVSS 4.0 scale and a version 4.0.9.8 was released to fix it.
Jimiens has released a version 4.0.9.8 to address the vulnerability, automatically applying the update when the program is run by existing users.
organisation IOC
Additionally, it has publicly disclosed the IOC related to the malicious DLL archive.dll and the malicious installer file AllMyBasic.msi.
organisation JEMENSSofteware Center
JEMENSSofteware Center Chwiyakjeom Silje Gonggyeoke Akyong, Jeongsang Peurogeuraemeuro Akseongkodeu Silhaeng.
organisation Siemens
A security vulnerability discovered in Siemens' software management program has been found to be exploited in actual malicious code distribution attacks.
organisation The Siemens
The Siemens Software Center is a program that manages the download, installation, activation, and update of purchased software by customers.
organisation DLL
Attackers placed the malicious DLL in the same folder as the officially signed Siemens executable files they had created.
organisation ClickFix
The attack is linked to a ClickFix (ClickFix) malicious code campaign called 'Romulus'.
organisation ForeScout
Cybersecurity company ForeScout recently analyzed that Romulus is being used to publish various malicious codes.
organisation StarDoc
ForeScout also revealed a case of a DLL side-loading using the standard signature programs of Canon and StarDoc.
organisation ChagPT
However, it is unclear whether the Jemen attack and the related case using the ChagPT campaign were carried out by the same attackers.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
ClickFix is a social engineering attack that shows the user a fake CAPTCHA authentication or system error solution screen and prompts the user to copy and input specific commands directly into the Windows command prompt or PowerShell.
Metrics
infrastructure
‎8.4
Software Version
The vulnerability was evaluated at 8.4 points on the CVSS 4.0 scale and a version 4.0.9.8 was released to fix it.
Metrics
infrastructure
‎4.0
Software Version
The vulnerability was evaluated at 8.4 points on the CVSS 4.0 scale and a version 4.0.9.8 was released to fix it.
Metrics
infrastructure
‎4.0.9
Software Version
The vulnerability was evaluated at 8.4 points on the CVSS 4.0 scale and a version 4.0.9.8 was released to fix it.
Jimiens has released a version 4.0.9.8 to address the vulnerability, automatically applying the update when the program is run by existing users.
Intelligence Sources
Dailysecu 2026-10-21