CYBERSECURITY researchers have identified ROMULUS as a new, multi-payload delivery platform built on the ClickFix technique, used to disseminate a range of malware via an expanding ecosystem. Investigators from Vedere Labs, part of Forescout Research, uncovered the server hosting panel ROMULUS while probing an incident, noting that the same ClickFix-delivered malware seen in another campaign is linked to a different server connected to the same investigation.
ROMULUS is described as a reusable delivery backend rather than a single, hard-coded malware server, suggesting the infrastructure is being operated at scale to support multiple campaigns.
In total, six different ROMULUS servers were identified, indicating the toolkit-like nature of the operation and the potential for widespread abuse by various cybercriminal groups. The platform also demonstrated an unusual technique to cloak activity: one delivery route distributed LegionLoader, a multi-pronged malware delivery framework, via encrypted archives that contained an executable inflated to about 842 MiB. This file size could help attackers bypass some security scans and analysis tools.
Researchers emphasise that ROMULUS marks an evolution of ClickFix—from a social engineering approach into an operational malware delivery infrastructure with diversified delivery methods and disguised activity. The operators behind ROMULUS remain unidentified, and the platform is distinct from RomulusLoader, a separate malware family previously noted by Proofpoint.