Threat actors recently leveraged a delivery platform named ROMULUS to distribute malware through ClickFix lures, often accessed via malicious links served through custom chatbot configurations. The infrastructure consists of multiple servers exposing a dark-themed authentication interface, allowing operators to manage distinct delivery tokens. These tokens route victims to either trojanized software installers or encrypted archive chains. The platform appears to be a reusable backend rather than a single hard-coded server, supporting various payload types including remote access tools and loaders. The initial access vector relies on social engineering to trick users into executing malicious scripts, while the operator identity and specific victim counts remain unknown at the time of analysis.
The execution chain begins with heavily obfuscated PowerShell scripts that reconstruct code from integer arrays and delete themselves after execution. One route downloads a trojanized installer for a legitimate de-elevation tool, which uses a patched dynamic link library to sideload a malicious loader. This loader then accesses encrypted payload storage within the installation directory. A second route downloads a legitimate archive utility and a password-protected archive from an external domain. The archive contains nested encrypted files and an artificially inflated executable designed to exceed sandbox size limits. This executable uses multiple decryption stages, including AES and byte reversal, to ultimately deploy a loader that communicates with command and control servers using RC4 and Base64 encoded messages. The loader also targets browser credentials stored in local state files.[/subscribe_to_unlock_form]
Threat actors recently leveraged a delivery platform named ROMULUS to distribute malware through ClickFix lures, often accessed via malicious links served through custom chatbot configurations. The infrastructure consists of multiple servers exposing a dark-themed authentication interface, allowing operators to manage distinct delivery tokens. These tokens route victims to either trojanized software installers or encrypted archive chains. The platform appears to be a reusable backend rather than a single hard-coded server, supporting various payload types including remote access tools and loaders. The initial access vector relies on social engineering to trick users into executing malicious scripts, while the operator identity and specific victim counts remain unknown at the time of analysis.
The execution chain begins with heavily obfuscated PowerShell scripts that reconstruct code from integer arrays and delete themselves after execution. One route downloads a trojanized installer for a legitimate de-elevation tool, which uses a patched dynamic link library to sideload a malicious loader. This loader then accesses encrypted payload storage within the installation directory. A second route downloads a legitimate archive utility and a password-protected archive from an external domain. The archive contains nested encrypted files and an artificially inflated executable designed to exceed sandbox size limits. This executable uses multiple decryption stages, including AES and byte reversal, to ultimately deploy a loader that communicates with command and control servers using RC4 and Base64 encoded messages. The loader also targets browser credentials stored in local state files.[emaillocker id="1283"]
The platform demonstrates active development and scale, with multiple servers identified through web fingerprinting and statistics pages tracking unique installs and country breakdowns. The use of inflated executables and encrypted archives indicates an effort to evade static analysis and upload limits. Defensive implications include monitoring for PowerShell execution with hidden windows, silent installer activity from temporary directories, and unusual file sizes in user-writable paths. Network visibility is critical for detecting the specific command and control endpoints and the distinctive message framing used by the loader. Organizations should also review browser-to-PowerShell process ancestry to identify potential ClickFix compromises.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1204.004 | User Execution | Malicious Copy and Paste |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Persistence | T1574.002 | Hijack Execution Flow | DLL Side-Loading |
| Defense Evasion | T1027.010 | Obfuscated Files or Information | Command Obfuscation |
| Defense Evasion | T1027.001 | Obfuscated Files or Information | Binary Padding |
| Defense Evasion | T1027.013 | Obfuscated Files or Information | Encrypted or Encoded File |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | - |
| Defense Evasion | T1218.007 | System Binary Proxy Execution | Msiexec |
| Credential Access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Discovery | T1518.001 | System Information Discovery | Security Software Discovery |
| Command and Control | T1105 | Ingress Tool Transfer | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
| Defense Evasion | F0007 | Self Deletion |
| Command and Control | E1105 | Ingress Tool Transfer |
| Cryptography Micro-objective | C0027 | Encrypt Data |
| Cryptography Micro-objective | C0031 | Decrypt Data |
| Memory Micro-objective | C0007 | Allocate Memory |
| Command and Control | B0030 | C2 Communication |
| Communication Micro-objective | C0002 | HTTP Communication |
| Discovery | E1082 | System Information Discovery |
| Collection | E1560 | Archive Collected Data |
| File System Micro-objective | C0052 | Writes File |
| Process Micro-objective | C0017 | Create Process |
The following reports contain further technical details:
[/emaillocker]