Forescout Details ROMULUS ClickFix Platform Delivering Legion Loader

ROMULUS turns ClickFix lures into malware delivery

Cybersecurity researchers at Forescout have disclosed a ClickFix delivery platform called ROMULUS that is being used to distribute malware such as Legion Loader. The platform operates like a malware delivery service by placing ClickFix style lures on bogus landing pages and tricking users into running malicious commands that infect their own machines.

Sai Molige, a security researcher involved in the analysis, said ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. Forescout identified six IP addresses running ROMULUS: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, and 2.27.248[.]127.

From PowerShell staging to Legion Loader

The researchers said 96.62.224[.]81 was previously identified as hosting a ClickFix script and an MSI installer file in a campaign that used malicious ChatGPT Custom GPTs to send victims to a fake URL serving the ClickFix lure. Forescout later found the same malware being delivered through 86.109.75[.]7, which also hosted a panel codenamed ROMULUS.

A separate ClickFix chain has been used to run a PowerShell script that delivers Legion Loader, also called Satacom downloader, CurlyGate, and RobotDropper. ROMULUS exposes two endpoints designed to download a PowerShell staging script, which then decides whether the next payload is a trojanized MSI installer carrying a malware loader or an encrypted archive containing Legion Loader. The loader communicates with a remote server to fetch and run additional payloads.

Attribution and defense

Forescout said it is not known who is behind ROMULUS. The platform shares no overlaps with RomulusLoader, a malware family associated with Silver Fox, also known as TA4922, a China aligned threat actor that has used tax related pretexts to distribute remote access trojans such as ValleyRAT (also called Winos 4.0), DcRAT, and potentially Venom RAT through DLL sideloading.

The findings indicate that ClickFix is evolving beyond a social engineering technique into an effective entry point for malware. Forescout recommended hunting for suspicious PowerShell commands and DLL sideloading events to mitigate the threat.

Sources: The Hacker News