Forescout Research’s Vedere Labs has disclosed ROMULUS, a malware delivery platform that uses fake landing pages and ClickFix-style instructions to persuade users to execute malicious commands on their own computers.
According to The Hacker News’s account of the Vedere Labs analysis, an observed ROMULUS infection chain launches PowerShell and ultimately installs Legion Loader, also known as Satacom downloader, CurlyGate, and RobotDropper. The loader then contacts remote infrastructure to obtain and execute further payloads.
ROMULUS is the delivery platform, while Legion Loader is malware distributed through it. The identity of the platform’s operator remains unknown.
PowerShell stages two alternative delivery paths
ROMULUS exposes two endpoints that provide a PowerShell staging script. After execution, the script selects one of two next-stage packages:
- a trojanized MSI installer containing a malware loader;
- an encrypted archive containing Legion Loader.
The encrypted archive is padded with repetitive data until it approaches 1 GB. Vedere Labs assessed that this inflation is designed to interfere with security controls that impose upload-size limits, restrict sandbox execution time or apply thresholds during static analysis.
Once active, the loader retrieves additional payloads from a remote server. The report identifies Legion Loader in the observed chain but does not name the subsequent malware delivered through that final stage.
The attack depends on the victim following instructions presented by a deceptive page. That user-driven execution gives PowerShell a central role in the chain and can make the activity resemble an action initiated locally rather than a conventional downloaded executable launched directly from the browser.
Infrastructure linked to the platform
The researchers identified six IP addresses running ROMULUS infrastructure:
96.62.224[.]81
86.109.75[.]7
151.240.151[.]223
23.94.145[.]224
93.152.224[.]118
2.27.248[.]127
The host at 96.62.224[.]81 served a ClickFix script and an MSI installer associated with a separate campaign. In that operation, malicious ChatGPT Custom GPTs directed users to a fraudulent URL that displayed the ClickFix lure. The reporting does not identify that campaign’s operator or describe its scope.
The address 86.109.75[.]7 delivered the same malware and hosted a control panel that researchers codenamed ROMULUS.
These indicators can support retrospective searches when retained with their reported roles. A match alone does not establish which operator was responsible for an event or whether every connection belongs to the same campaign.
ROMULUS is distinct from RomulusLoader
Despite the similar names, the researchers reported no overlap between ROMULUS and RomulusLoader. The latter is a separate malware family associated in the source with Silver Fox, also tracked as TA4922.
Vedere Labs researcher Sai Molige offered several possible explanations for ROMULUS’s operating model: it could be a privately controlled panel, a commercial delivery service, an affiliate framework or software shared or copied among different operators. These remain assessments rather than an attribution to a named threat actor.
Detection should focus on execution and sideloading
Vedere Labs recommends hunting for suspicious PowerShell command execution and DLL sideloading events. For this chain, defenders can examine those signals alongside the reported infrastructure, MSI or unusually large encrypted-archive delivery, and subsequent outbound activity from a newly launched loader.
The findings show how ClickFix can function as a repeatable initial-access mechanism rather than a single deceptive prompt: the landing page drives user execution, ROMULUS stages the chosen package, and Legion Loader opens the path for additional malware.
