Key points
- ROMULUS acts as a malware delivery service using ClickFix lures on bogus landing pages.
- The platform distributes LegionLoader, also known as Satacom downloader or RobotDropper.
- Forescout Research identified six IP addresses associated with the ROMULUS infrastructure.
The ROMULUS platform operates as a malware delivery service that employs ClickFix-style lures on fraudulent landing pages to trick users into executing malicious commands. According to Forescout Research - Vedere Labs, this mechanism infects machines by convincing victims to run scripts themselves. The platform facilitates the distribution of LegionLoader and other payloads.
By the numbers
- Six IP addresses were identified as running the ROMULUS platform.
- One IP address hosted both a ClickFix script and an MSI installer file.
- Two endpoints exposed by the platform download PowerShell staging scripts.
What the figures mean
Security researcher Sai Molige noted that ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. Forescout analysis uncovered the same malware being delivered via server 86.109.75[.]7, which hosted a panel codenamed ROMULUS. Another IP, 96.62.224[.]81, hosted a ClickFix script and MSI installer linked to a campaign using malicious ChatGPT Custom GPTs to direct victims to fake URLs.
The ROMULUS platform exposes two endpoints designed to download a PowerShell staging script that decides the next payload. This script fetches either a trojanized MSI installer carrying a malware loader or an encrypted archive containing LegionLoader. The loader then communicates with a remote server to fetch and run additional payloads. LegionLoader is also referred to as Satacom downloader, CurlyGate, and RobotDropper.
What to watch
Forescout stated it is not known who is behind the ROMULUS platform. The report clarified that this infrastructure shares no overlaps with RomulusLoader, a malware family associated with Silver Fox, a China-aligned threat actor known for using tax-related pretexts to distribute remote access trojans like ValleyRAT and DcRAT via DLL sideloading.
Infection and persistence in general
Teams usually examine browser history and command-line logs to find social engineering lures. Analysts check for unexpected PowerShell executions that download scripts from external domains. They inspect temporary directories for MSI installers or encrypted archives dropped by staging scripts. Defenders monitor network traffic for connections to newly created domains or unusual ports used by loaders. Checking for DLL sideloading events helps detect persistence mechanisms that load malicious libraries alongside legitimate applications.
What to do and how to stay safe: ROMULUS
- Monitor endpoint logs for unexpected PowerShell commands that download or execute remote scripts, as this is a common staging technique.
- Inspect browser history and proxy logs for visits to bogus landing pages that prompt users to run local commands or installers.
- Watch for network connections to newly registered domains or IP addresses that do not match known business traffic patterns.
- Verify that application control policies block unauthorized MSI installers and encrypted archives from executing in user directories.
Step-by-step guide: Ransomware Incident Response: A Step-by-Step Operational Playbook
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the ROMULUS platform?
ROMULUS is a malware delivery service that uses ClickFix-style lures on fake landing pages to trick users into running malicious commands that install loaders like LegionLoader.
Is ROMULUS related to the RomulusLoader malware family?
No, the report states that the ROMULUS platform shares no overlaps with RomulusLoader, which is associated with the China-aligned threat actor Silver Fox.
How does the ROMULUS platform deliver payloads?
The platform exposes endpoints that download a PowerShell staging script, which then fetches either a trojanized MSI installer or an encrypted archive containing LegionLoader.
