ROMULUS Platform Emerges as Sophisticated Malware Delivery System
A new platform named ROMULUS is enabling threat actors to deliver malware through deceptive ClickFix traps, employing advanced evasion techniques to bypass security defenses.
Cybercriminals are now leveraging a newly identified platform, dubbed ROMULUS, to distribute malware via "ClickFix" traps. This sophisticated system combines hidden PowerShell scripts, tampered software installers, and encrypted archives to evade detection by security software. Researchers from Forescout's Vedere Labs uncovered ROMULUS while investigating an unrelated incident, detailing its multi-faceted approach to malware delivery.
The ROMULUS platform supports distinct infection paths, including one that deploys the LegionLoader malware and another that abuses a legitimate Stardock program for DLL sideloading. This strategy allows a single delivery infrastructure to serve various malware packages while masking malicious activity behind trusted applications. ClickFix tactics typically trick users into executing commands themselves, often through fake verification prompts or repair instructions, turning a routine browser interaction into the initial stage of a Windows infection.
Forescout's analysis revealed six IP addresses exposing the same login panel for the ROMULUS platform. The platform appears to function as a reusable backend for malware delivery rather than a bespoke server for a single payload. Its infection routes utilize twelve-character tokens to retrieve either PowerShell staging scripts or malicious MSI installers. The exact purpose of these tokens—whether they identify victims, campaigns, assignments, or specific delivery jobs—remains unconfirmed.
An exposed statistics page within the ROMULUS interface tracked metrics such as unique installs, total runs, a fourteen-day history, and geographical data, suggesting operators can monitor campaign performance. However, the evidence does not definitively establish whether ROMULUS is a private tool, a commercial criminal service, an affiliate system, or shared software among different threat groups.
One observed delivery chain involved a tampered MSI installer disguised as the "Stardock Smart DeElevation Tool." After installation, this package launched a genuine Stardock executable, which then loaded a malicious DLL from its own directory. This DLL sideloading technique allows attackers to leverage legitimate software as a launchpad for executing harmful code, making detection more challenging.
A second delivery route involved hiding PowerShell windows and downloading an encrypted archive alongside the legitimate 7-Zip command-line utility. This archive was password-protected, with the password provided in a separate text file. The encrypted headers concealed filenames and contents from scanners that lacked the password, serving as an evasion method to bypass security thresholds, particularly those related to file size.
After decryption, the extracted executable, despite its large size, was found to contain significant padding. Two unpacking stages employed AES encryption and byte reversal before loading LegionLoader into memory. LegionLoader itself is known for registering infected systems, receiving commands, executing PowerShell scripts, and downloading additional payloads. It has also been observed accessing Chrome's Local State key material to exfiltrate sensitive browser data, with its command traffic encrypted using RC4 and Base64 encoding.
Forescout recommends that security teams monitor PowerShell script logs, silent MSI installations originating from temporary folders, unusual DLL loads, and unusually large executables. Network visibility can help detect form requests containing Base64 blobs instead of standard fields. The researchers also advise users to be wary of verification pages demanding command execution and for security teams to scrutinize files that might be skipped due to size limits.