Cybersecurity
Researchers trace ROMULUS platform to Legion Loader deliveries
Forescout Research - Vedere Labs said a ROMULUS ClickFix platform was delivering Legion Loader through staged scripts and fake landing pages, while the operator behind it remained unidentified in its analysis.
- Forescout Research - Vedere Labs said ROMULUS was a ClickFix delivery platform used to spread Legion Loader.
- Sai Molige said ROMULUS could be a private panel, a commercial delivery service, an affiliate framework or copied software.
- Forescout said it found six IP addresses linked to ROMULUS, including 96.62.224[.]81 and 86.109.75[.]7.
- The article said 96.62.224[.]81 hosted a ClickFix script and MSI installer in another campaign, while 86.109.75[.]7 hosted a ROMULUS panel.
- The researchers said the platform used PowerShell staging scripts to fetch either a trojanised MSI installer or an encrypted archive containing Legion Loader, and the archive was padded to nearly 1 GB.
Forescout Research - Vedere Labs said ROMULUS was a delivery platform that used ClickFix lures on false landing pages to get users to run malicious commands. Its researcher Sai Molige said it might be a private panel, a commercial delivery service, an affiliate framework or copied software.
The company said it had found six IP addresses running ROMULUS. It also said 96.62.224[.]81 had hosted a ClickFix script and MSI installer in another campaign, and that 86.109.75[.]7 had hosted a ROMULUS panel.
Forescout said a separate ClickFix chain ran a PowerShell script that then delivered Legion Loader. The loader was also called Satacom downloader, CurlyGate and RobotDropper.
The platform exposed two endpoints that fetched a PowerShell staging script. That script then pulled either a trojanised MSI installer or an encrypted archive holding Legion Loader; the archive was padded to nearly 1 GB.
The article said it was not known who was behind ROMULUS, and that it did not overlap with RomulusLoader, which was associated with Silver Fox. The researchers said defenders should look for suspicious PowerShell commands and DLL sideloading events.
Named in this story
People
- Sai Molige
- described ROMULUS as possibly several kinds of delivery operation
Organisations
- Forescout Research - Vedere Labs
- disclosed the findings and identified the infrastructure
- Silver Fox
- the threat actor group associated with RomulusLoader
Products and systems
- ROMULUS
- the ClickFix delivery platform used to distribute malware
- Legion Loader
- the malware loader delivered through the platform
- PowerShell
- the scripting tool used in the delivery chain
- RomulusLoader
- a different malware family the article said was unrelated to ROMULUS
How the source tells it
The piece is a technical research report in a restrained register, with no distinct emotive framing beyond a brief mitigation note.
No emotive framing was found in the original.