Threat reportMalwareTL-2026-3517
ROMULUS Malware Delivery Server Leverages ClickFix to Deliver Multiple Payloads (incl. LegionLoader)
ROMULUS Malware Delivery Server Leverages ClickFix to (TL-2026-3517), also tracked as ROMULUS, is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows, maps to 11 MITRE ATT&CK techniques (T1027.001, T1027.013, T1055.012), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3517
- Threat ID
- TL-2026-3517
- Also known as
- ROMULUS
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in ROMULUS Malware Delivery Server Leverages ClickFix to
Malware and tooling: ROMULUS, Satacom
How ROMULUS Malware Delivery Server Leverages ClickFix to works
Vedere Labs (Forescout Research) reports ROMULUS, a reusable multi-payload ClickFix delivery platform rather than a single hard-coded malware server. One route delivers LegionLoader via encrypted archives containing an executable inflated to approximately 842 MiB. Six servers running ROMULUS were identified; operator identity is unknown.
Vedere Labs, the research arm of Forescout, describes ROMULUS as a multi-payload, shared ClickFix delivery platform: reusable backend infrastructure that can serve different malware to victims, and that appears to function as a toolkit usable by multiple cybercriminals. Six separate servers running ROMULUS were identified. The primary Forescout report could not be retrieved; the details below come from the Infosecurity Magazine write-up (2026-10-14) and are supplemented by separately sourced LegionLoader/ClickFix reporting.
ClickFix is a social engineering technique in which the victim is persuaded to run attacker-supplied commands themselves. Because a legitimate user performs the execution, the technique sidesteps many automated security protections. Related reporting (AhnLab ASEC, 2026-09-03) describes a LegionLoader ClickFix chain: victims reach fake Cloudflare CAPTCHA pages via compromised wiki pages or phishing emails, are told to paste a PowerShell command from the clipboard, and the command downloads encrypted shellcode and PE files that a custom PE loader decrypts before a final backdoor beacons to its C2. Netskope documents LegionLoader as retrieving a Base64/RC4-encrypted configuration from hard-coded C2 servers, using process hollowing, XTEA-encrypted shellcode and anti-sandbox checks. These ASEC/Netskope indicators are LegionLoader-family context and are not confirmed by any source to be hosted on ROMULUS servers.
One ROMULUS delivery route distributes LegionLoader through encrypted archives containing an executable artificially inflated to approximately 842 MiB, which the source describes as intended to circumvent file-size scanning limits.
ROMULUS is distinct from RomulusLoader, a separate loader family documented by Proofpoint (2026-06-03) in TA4922 campaigns. The ROMULUS article names no CVEs, IOCs, targets or attribution; severity is an analyst assessment rather than source-stated.
MITRE ATT&CK techniques used in TL-2026-3517
Defense Evasion
T1027.001 Binary Padding; T1027.013 Encrypted/Encoded File; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.002 User Activity Based Checks
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1573.001 Symmetric Cryptography
Resource Development
Affected products and versions in ROMULUS Malware Delivery Server Leverages ClickFix to
- Microsoft — Windows
Vulnerable versions: Windows endpoints where users can run PowerShell or the Run dialog
Remediation for ROMULUS Malware Delivery Server Leverages ClickFix to
Immediate actions
- Warn users never to paste or run commands from web pages, CAPTCHA or verification prompts
- Hunt for Run dialog, PowerShell or terminal executions (e.g. powershell -w h -ep bypass with irm/iex-style download) spawned shortly after browser activity
- Flag or quarantine encrypted archives that expand to abnormally large executables
- Block the LegionLoader-context domains and IP listed in the IOCs at DNS/proxy/firewall
Workarounds
- Configure endpoint scanning to inspect, not skip, oversized files and encrypted archives
Longer-term hardening
- Restrict the Windows Run dialog and script interpreters for non-administrative users where feasible
- Deploy EDR with behavioral detection of clipboard-to-shell execution chains
- Run ClickFix awareness training
Timeline of ROMULUS Malware Delivery Server Leverages ClickFix to
- Australian Cyber Security Centre issues a ClickFix warning, cited in the ROMULUS coverage as related prior context.
- Proofpoint publishes analysis of TA4922 campaigns deploying Atlas RAT and RomulusLoader, a separate malware family from the ROMULUS delivery platform.
- The Hacker News reports ClickFix campaigns delivering BabaDeda, Lorem Ipsum and Potemkin loaders via fake update lures, showing broad ClickFix loader adoption.
- AhnLab ASEC publishes analysis of LegionLoader distributed via fake Cloudflare CAPTCHA ClickFix pages, with C2 and distribution indicators.
- Infosecurity Magazine reports Vedere Labs (Forescout Research) findings: ROMULUS multi-payload ClickFix delivery platform on six servers, with a LegionLoader route using an ~842 MiB inflated executable.
- Disclosure that one ROMULUS route delivers LegionLoader in encrypted archives holding an executable inflated to roughly 842 MiB to exceed scanning size limits; six ROMULUS servers identified, operator unknown.
- Vedere Labs (Forescout Research) publishes its blog post on ROMULUS, per Infosecurity Magazine; the primary post URL was not retrievable and no IOCs are given in the coverage.
Sources cited for ROMULUS Malware Delivery Server Leverages ClickFix to
- ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
- Beware of the LegionLoader malware being distributed via the ClickFix method - ASEC
- New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile - Netskope
- ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
- Proofpoint Warns TA4922 Deploys Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT
- LegionLoader Exposed - TEHTRIS
- TerminalFix and Lorem Ipsum Loader Enable Covert Tunneling - Sophos
Detection coverage for TL-2026-3517
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3517 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.