Attackers Are Hiding Malware Behind a Signed Siemens Installer: A Checklist for Design and Production Shops

If your shop designs parts in Solid Edge or NX, you've probably got Siemens Software Center on the CAD workstations. It's the Siemens app that downloads, installs, activates and updates the design software you've paid for. On Oct. 19, 2026, Siemens confirmed that attackers are using a flaw in it, and CISA added the bug (CVE-2026-110936) to its Known Exploited Vulnerabilities list the next day.

The twist: the attackers aren't breaking into Siemens customers through their existing installs. They're bundling a genuine, digitally signed copy of the Siemens program with their own malicious files and tricking people into running it. That means a PC that has never had Siemens software on it can still end up running "Siemens Software Center." Design, engineering and production shops should do two things this week: update the real installs, and look for fake ones.

What's been reported

The bug. Siemens advisory SSA-580366 (published Oct. 15) says every version of Siemens Software Center before 4.0.9.8 loads helper files (DLLs) from a folder it doesn't control. Anyone who can drop a booby-trapped file in that folder gets their code run under the trusted program's name. Siemens rates it 8.4 on CVSS v4 (6.7 on v3.1) and credits Huntress for reporting it.
The fix updates itself, but only when the app starts. Siemens says existing installs "will be auto updated on next startup" to 4.0.9.8 or later. A copy nobody has opened in months is still on the old version.
How it's being used. In its Oct. 19 exploitation notice, Siemens says the attackers used "a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it." Version 3.5.8.7, the newest at the time, loaded those files without checking them. Siemens says the program itself wasn't modified and that "no Siemens system, product or update channel was breached to our knowledge."
The delivery trick is ClickFix. Siemens ties the activity to a ClickFix operation called Romulus. SecurityWeek explains that ClickFix uses fake prompts, such as bogus "I'm not a robot" checks, that tell the visitor to paste and run a command on their own PC. Forescout, which published research on Romulus on Oct. 15, describes it as a reusable delivery platform that hands out several kinds of malware; SecurityWeek reports one of its servers is the one Siemens identified as the source of the malicious bundle.
Federal deadline. CISA's KEV catalog gives federal agencies until Nov. 3. That date binds agencies, not you, but it tells you how CISA rates the risk.
What isn't known. Siemens hasn't said how many PCs were hit, and no company has been publicly named as a victim.

Why a design or production shop should care

CAD workstations are usually the most powerful PCs in the building, and they hold the drawings, models and customer specs your business runs on. They're also the machines where people install trial software and plug-ins most often. Security tools that trust anything signed by a big vendor will wave this through, which is why Siemens tells defenders to watch for behavior and folders, not the file's fingerprint: the Siemens file itself is real.

The other half is the people. ClickFix only works if someone pastes a command they were told to run. One short conversation with your team closes that door for this campaign and the next one.

Clear takeaway

Open Siemens Software Center on every PC that uses it so it updates to 4.0.9.8 or later, and check every other PC for a copy that shouldn't be there. Tell staff that no real website ever asks them to paste a command into Windows.

What to do this week

List the PCs that should have it. Any workstation running Solid Edge, NX or other Siemens design software installed through Siemens Software Center.
Start the app and confirm the version. On each of those PCs, launch Siemens Software Center so it pulls the update, then confirm it shows 4.0.9.8 or later. If it can't reach the update service, download the current version from Siemens' official page.
Look for copies on PCs that shouldn't have it. Siemens' warning signs: "Siemens Software Center" in start-up apps or Task Scheduler on a PC that never had it; a folder named SM Software Provisioning Service under AppData\Local\Programs; files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe; or a folder named FTSuite with a file ftc.uml under AppData\Local.
Block the known addresses. Have whoever manages your firewall or DNS filter block the indicators Siemens published (an active IP and domain, plus the old distribution server) and search logs for past connections to them.
If you find one, treat it as an infection. Disconnect the PC from the network, stop the process, remove the start-up entry and scheduled task, and reset passwords used on that machine, as Siemens recommends. Then have it checked properly before it goes back on the network.
Only install from official sources. Siemens notes the attackers spread the signed program "outside official channels." Software for CAD seats should come from the vendor's site or your reseller, installed by whoever manages your PCs.
Brief the team in five minutes. Never paste a command from a web page into the Run box (Win+R), PowerShell or a terminal. A real CAPTCHA never asks for that. If a page says to, close it and tell IT.

How Brotherly Technology can help

Brotherly Technology can inventory your CAD and production workstations, confirm Siemens Software Center is updated, sweep every PC for the warning signs Siemens listed, and block the published addresses at your firewall. If your design seats were set up years ago by someone who's moved on, call us and we'll check them this week.