Six IPs Host ROMULUS Platform for ClickFix Malware Delivery

Security researchers have detailed a malware delivery infrastructure called ROMULUS that distributes LegionLoader and other malicious tools. According to Forescout Research, the platform operates as a service that lures victims into executing commands via deceptive landing pages. This method leverages the ClickFix technique to bypass traditional security controls by having users install malware themselves.

How does the ROMULUS platform function?

The ROMULUS platform operates similarly to a malware delivery service. It hosts bogus landing pages that present ClickFix-style lures. These lures are designed to trick users into running malicious commands on their own machines. The platform exposes two specific endpoints. One endpoint downloads a PowerShell staging script that determines the next payload. The other endpoint serves either a trojanized MSI installer or an encrypted archive containing the malware.

What payloads are delivered through this infrastructure?

The primary payload delivered through ROMULUS is LegionLoader. This malware loader is also referred to as Satacom downloader, CurlyGate, and RobotDropper. Once the PowerShell script executes, it fetches and runs the loader. The loader then communicates with a remote server to retrieve and execute additional payloads. This modular approach allows attackers to stage different threats depending on the target environment or operator preference.

Which servers are associated with ROMULUS?

Forescout identified six IP addresses running the ROMULUS platform. One specific address, 96.62.224[.]81, was found hosting a ClickFix script and an MSI installer. This IP was connected to a campaign using malicious ChatGPT Custom GPTs to direct victims to fake URLs. Another server, 86.109.75[.]7, also hosted the ROMULUS panel. These servers serve as the command and control nodes for the delivery chain.

Who is behind the ROMULUS operations?

The identity of the operators behind ROMULUS remains unknown. Security researcher Sai Molige noted that the platform could be a privately operated panel, a commercial delivery service, or an affiliate framework. It might also be software copied between different criminal operators. The platform shares no overlaps with RomulusLoader, a malware family linked to the China-aligned threat actor Silver Fox. This distinction suggests separate origins for the two entities.

Detection notes

Teams should monitor logs for unusual PowerShell execution patterns, particularly scripts downloaded from external web sources. Analysts should check for MSI installer events triggered by web browsers or remote scripts, as this indicates user interaction with a ClickFix lure. Network traffic logs should be reviewed for connections to newly registered or suspicious domains hosting download endpoints. Endpoint detection systems should alert on processes that launch PowerShell with encoded commands or arguments pointing to remote URLs. Immediate containment involves isolating affected endpoints to prevent lateral movement and blocking identified command and control IPs at the firewall.

Background: Lateral movement

Stop lateral movement by enforcing least privilege, segmenting networks, and monitoring internal traffic. This checklist provides specific controls to limit an attacker’s ability to move between systems after gaining initial access.

Read the full guide: Lateral Movement Prevention Checklist for Network Security

What to do and how to stay safe: ROMULUS

• Monitor endpoint logs for PowerShell processes initiated by web browsers or unexpected parent processes.
• Block network traffic to and from the identified ROMULUS IP addresses at your perimeter firewall.
• Train users to recognize ClickFix lures, which often ask them to run commands to "fix" a fake issue.
• Review MSI installation events for packages that were not approved or expected by your IT team.

Step-by-step guide: Ransomware Response: Steps to Contain, Recover, and Prevent Recurrence

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is ROMULUS related to the RomulusLoader malware family?

No, the ROMULUS platform shares no overlaps with RomulusLoader, which is associated with the China-aligned threat actor Silver Fox.

What is the primary malware distributed by ROMULUS?

The primary payload is LegionLoader, which is also known as Satacom downloader, CurlyGate, and RobotDropper.

How many IP addresses are linked to the ROMULUS platform?

Forescout Research identified six IP addresses running the ROMULUS platform infrastructure.