ROMULUS ClickFix platform delivers LegionLoader malware
Forescout researchers say the ROMULUS panel is routing ClickFix lures and multiple malware payloads, including LegionLoader.
Security researchers have detailed ROMULUS, a new ClickFix delivery platform that is being used to distribute malware including LegionLoader, also known as Satacom downloader, CurlyGate and RobotDropper.12 Forescout's Vedere Labs says the platform behaves like a reusable backend rather than a single hard-coded server, with multiple routes capable of delivering different payloads.2
The researchers identified six IP addresses exposing ROMULUS instances. The dark-themed panel uses a login page and provides tokenised routes that can deliver a PowerShell staging script or a trojanised MSI installer. The staging script decides what payload should be fetched next, while the malware loader can contact a remote server to retrieve and run additional components.2
One delivery chain reused a Stardock DeElevation sideloading package previously associated with another ClickFix campaign. A separate route delivered LegionLoader through an encrypted archive padded to almost 1GB. Forescout says the padding may be intended to bypass upload limits, sandbox budgets or static-analysis thresholds.2
The identity of the ROMULUS operator remains unknown. Forescout also found no evidence that this platform is connected to RomulusLoader, a separate malware family associated with the Silver Fox threat actor. That distinction matters because similar names do not establish shared ownership or infrastructure.12
Forescout recommends hunting for long PowerShell scripts launched from temporary directories, silent MSI installations, hidden or policy-bypassing PowerShell commands and suspicious base64 POST requests. The findings show how ClickFix is developing from a social-engineering trick into a flexible delivery mechanism that can hand victims different payloads depending on the campaign.12
Our opinion
ROMULUS is notable less for its branding than for its modularity. A delivery panel that can route several malware chains gives operators a reusable piece of infrastructure and makes simple, one-family detection less dependable. Defenders should treat the reported PowerShell, MSI and network indicators as practical starting points, while remembering that Forescout has not attributed the platform or established a relationship with RomulusLoader.12