threat actor · Origin not attributed
Romulus
1 CVE exploited (1 in CISA KEV)
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open Romulus's actor pageRomulus is linked in reporting by Infosecurity Magazine and Security Online to a ClickFix campaign using a Siemens Software Center flaw to distribute malware. The record is thin, with two articles and no origin attribution on record; CVE-2026-110936 is reported as exploited, attributed by Forescout, SecurityWeek and Siemens.
Source: CyberSIXT summary, 14 November 2026. Written by CyberSIXT's model from CyberSIXT's own article summaries and records, and checked against them; read the articles before relying on it.
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage. Use this via MCP