Forescout: ROMULUS ClickFix Backend Distributes LegionLoader via Six Servers

Researchers at Forescout’s Vedere Labs unit discovered the ROMULUS server hosting panel while investigating an incident involving ClickFix tactics. This finding reveals how cybercriminals are evolving simple social engineering techniques into a full ecosystem for delivering multiple malware variants to victims.

What happened

Vedere Labs analysts identified the ROMULUS platform during an investigation into a specific security incident. They observed that malware delivered by a separate ClickFix campaign was connected to another server linked to their case. This new server hosted the ROMULUS panel, which functions as a multi-payload shared delivery infrastructure.

ClickFix relies on social engineering to trick users into running attacker-supplied commands on their own machines. Because the trusted user executes these commands, the actions often bypass security protections designed to stop unauthorized activity. The ROMULUS platform appears capable of deploying various attack routes to deliver different forms of malware.

Analysts identified six different servers running ROMULUS, suggesting the infrastructure operates as a toolkit for a wide range of cybercriminals. One delivery route distributed LegionLoader through encrypted archives containing an executable artificially inflated to approximately 842 MiB. This size potentially exceeds file-size limits imposed by security scanning and analysis tools.

GBHackers reported that the discovery connects infrastructure from a ChatGPT Custom GPT abuse campaign to an independently investigated incident. Huntress linked one server to attackers abusing Custom GPTs to direct victims toward fake verification pages. These pages used ClickFix instructions to persuade users to execute malicious PowerShell commands.

VirusTotal and Shodan searches identified six IP addresses exposing matching ROMULUS authentication panels. Login pages submitted credentials to /api/login and stored returned tokens before redirecting users to a dashboard. One server also exposed /stats.htm, displaying unique installations, total executions, and geographic distribution data.

Forescout stated that ROMULUS separates delivery through specific paths for PowerShell staging scripts and trojanized MSI installers. Observed tokens contained 12 hexadecimal characters, and different tokens selected different payload routes. This indicates configurable delivery infrastructure rather than a server dedicated to a single malware family.

Recovered scripts used layered integer-array obfuscation and reconstructed executable code through scriptblock creation. The scripts deleted themselves after execution. The Stardock route downloaded an installer using decimal IPv4 notation to represent the server address.

The script saved a GUID-prefixed installer in the temporary directory and removed its download-blocking marker. It then invoked msiexec.exe silently with specific flags to launch a legitimate executable. This process loaded a patched DLL that redirected execution into malicious code, as documented by Huntress.

Why it matters

The ROMULUS platform demonstrates how ClickFix is evolving beyond a simple social engineering technique into an entry point for broader malware operations. Attackers are diversifying their delivery infrastructure and disguising malicious activity to make threats harder to detect.

The identity of the operator behind the platform and common ownership of the final malware families remain unknown. However, the reuse of infrastructure across different campaigns suggests a scalable approach to distributing attacks.

Our take on the response

• Monitor for unusual PowerShell execution patterns, especially those involving scriptblock creation.
• Check for large encrypted archives that may exceed standard scanning size limits.
• Verify the integrity of legitimate applications like Stardock before execution.
• Review logs for connections to known malicious IP addresses or decimal IPv4 notations.

What defenders should look for

Teams usually see initial indicators in user behavior logs where employees execute unexpected commands. Check whether local administrators are running PowerShell scripts from temporary directories or downloading large files. Look for silent installations of MSI packages that do not match approved software lists. Containment moves typically involve isolating affected endpoints to prevent lateral movement. Review authentication logs for unusual dashboard access patterns. Disable compromised accounts immediately to stop further credential misuse.

Background: Social engineering

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It relies on trust, urgency, and authority to bypass security controls. Defenses require verifying identity through out-of-band channels and validating requests against established procedures.

Read the full guide: Social Engineering Explained: How Manipulation Bypasses Security

What to do and how to stay safe: ROMULUS

• Audit user permissions to ensure employees cannot run arbitrary PowerShell commands without approval.
• Configure email and web filters to block access to known malicious domains and IP addresses.
• Train users to recognize social engineering attempts that ask them to run commands or download files.
• Implement application control policies to restrict the execution of unsigned or unknown executables.

Step-by-step guide: Ransomware Backups: How Small Teams Survive Without Enterprise Budgets

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is ROMULUS?

ROMULUS is a shared ClickFix delivery platform identified by Forescout researchers that operates across six servers to distribute multiple malicious payloads.

How does ClickFix work?

ClickFix relies on social engineering to trick victims into running attacker-supplied commands on their own machines, bypassing security protections.

What malware does ROMULUS deliver?

The platform delivers LegionLoader and trojanized Stardock packages, using encrypted archives and obfuscated scripts to evade detection.