# ROMULUS Malware Delivery Server Leverages ClickFix to Deliver Multiple Payloads (incl. LegionLoader)

> Vedere Labs (Forescout Research) reports ROMULUS, a reusable multi-payload ClickFix delivery platform rather than a single hard-coded malware server. One route delivers LegionLoader via encrypted archives containing an executable inflated to approximately 842 MiB. Six servers running ROMULUS were identified; operator identity is unknown.

- **Published:** 2026-10-14T15:21:24Z
- **Last reviewed:** 2026-10-14T15:21:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3517
- **ID:** TL-2026-3517
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Vedere Labs, the research arm of Forescout, describes ROMULUS as a multi-payload, shared ClickFix delivery platform: reusable backend infrastructure that can serve different malware to victims, and that appears to function as a toolkit usable by multiple cybercriminals. Six separate servers running ROMULUS were identified. The primary Forescout report could not be retrieved; the details below come from the Infosecurity Magazine write-up (2026-10-14) and are supplemented by separately sourced LegionLoader/ClickFix reporting.

ClickFix is a social engineering technique in which the victim is persuaded to run attacker-supplied commands themselves. Because a legitimate user performs the execution, the technique sidesteps many automated security protections. Related reporting (AhnLab ASEC, 2026-09-03) describes a LegionLoader ClickFix chain: victims reach fake Cloudflare CAPTCHA pages via compromised wiki pages or phishing emails, are told to paste a PowerShell command from the clipboard, and the command downloads encrypted shellcode and PE files that a custom PE loader decrypts before a final backdoor beacons to its C2. Netskope documents LegionLoader as retrieving a Base64/RC4-encrypted configuration from hard-coded C2 servers, using process hollowing, XTEA-encrypted shellcode and anti-sandbox checks. These ASEC/Netskope indicators are LegionLoader-family context and are not confirmed by any source to be hosted on ROMULUS servers.

One ROMULUS delivery route distributes LegionLoader through encrypted archives containing an executable artificially inflated to approximately 842 MiB, which the source describes as intended to circumvent file-size scanning limits.

ROMULUS is distinct from RomulusLoader, a separate loader family documented by Proofpoint (2026-06-03) in TA4922 campaigns. The ROMULUS article names no CVEs, IOCs, targets or attribution; severity is an analyst assessment rather than source-stated.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1027.001 Binary Padding
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1497.002 User Activity Based Checks
- T1583.004 Server
- T1608.001 Upload Malware
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Sources

- [ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads](https://www.infosecurity-magazine.com/news/romulus-malware-clickfix-deliver/)
- [Beware of the LegionLoader malware being distributed via the ClickFix method - ASEC](https://asec.ahnlab.com/en/95374/)
- [New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile - Netskope](https://www.netskope.com/blog/new-evasive-campaign-delivers-legionloader-via-fake-captcha-cloudflare-turnstile)
- [ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures](https://thehackernews.com/2026/06/clickfix-campaigns-expand-malware.html)
- [Proofpoint Warns TA4922 Deploys Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT](https://www.cryptika.com/proofpoint-warns-ta4922-deploys-atlas-rat-romulusloader-silentrunloader-and-valleyrat/)
- [LegionLoader Exposed - TEHTRIS](https://tehtris.com/en/blog/legionloader-exposed/)
- [TerminalFix and Lorem Ipsum Loader Enable Covert Tunneling - Sophos](https://www.sophos.com/en-us/blog/terminalfix-and-lorem-ipsum-loader-enable-covert-tunneling)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3517