DNS Security

DNS Security vs ClickFix: Inside the ROMULUS Platform

By Nattapong Sukkasem · Published 2026-10-20 · Updated 2026-10-21.

TL;DR — Forescout's Vedere Labs has published an analysis of ROMULUS, a previously undocumented delivery platform sitting behind ClickFix campaigns. Six servers run the same admin panel, handing out obfuscated PowerShell stagers keyed to twelve-character tokens that pull either a trojanised Stardock installer or LegionLoader. One archive under 1 MB expands into a roughly 842 MB executable, almost all of it padding designed to exceed what scanners accept. No exploit is involved anywhere in the chain — the victim runs the first command personally. That is what makes this a DNS security story rather than a patching one.

Every control an organisation buys has a budget. A sandbox will only accept a file up to a certain size; an analyst will only read so far down an alert queue. ROMULUS, documented by Forescout on 15 October 2026, is interesting because almost every technique in it targets one of those budgets, not a vulnerability. The one checkpoint in its chain with no budget to exhaust — whose cost is identical whether the payload is a kilobyte or a gigabyte — is name resolution. That is the DNS security argument this campaign makes better than most.

The Santa Clara Valley and downtown San Jose, California, home of Forescout, whose Vedere Labs researchers documented the ROMULUS ClickFix delivery platform — Downtown San Jose seen across the Santa Clara Valley, photographed in 2009. Forescout, whose Vedere Labs team published the ROMULUS analysis, is based in San Jose.

What Forescout found

Vedere Labs found a ROMULUS server while working an unrelated incident, then pivoted on its login page through VirusTotal and Shodan to find five more. What they describe is not a bespoke malware server but a product: a dark-themed panel with a JavaScript login form posting to /api/login, and a statistics page reporting unique installs, total runs, a fourteen-day timeline and a country breakdown. Someone built this to be operated by people who did not write it.

Item	Detail
Research	Forescout Research — Vedere Labs, published 15 October 2026, credited to Sai Molige and the Vedere Labs team
What ROMULUS is	A reusable, multi-payload ClickFix delivery backend with an admin web panel, not a single hard-coded malware host
Infrastructure	Six IP addresses serving the same panel: `96.62.224[.]81`, `86.109.75[.]7`, `151.240.151[.]223`, `23.94.145[.]224`, `93.152.224[.]118`, `2.27.248[.]127`. Only the first two were analysed in depth
URL scheme	`/s/<token>` serves the PowerShell stager, `/app/<token>/<file>` an MSI. Tokens are twelve hexadecimal characters, possibly mapping to a victim, campaign or delivery job
Decimal addressing	Stager URLs use decimal-encoded IPs: `1450003207` is `86.109.75[.]7`, `1614733393` is `96.62.224[.]81`
Route A	`IconEdit2Turb.msi`, presenting itself as the “Stardock Smart DeElevation Tool”, sideloads a patched `DeElevator64.dll` and a loader named `I++u.dll` beside the legitimate `DeElevate64.exe`
Route B	A password-protected archive from `orbitflownetwork[.]lol` unpacks through three layers to LegionLoader, which reports to `smashshape[.]com` at `/nfront.php` and `/nback.php`
Carrier size	Final executable roughly 842 MB, of which about 881.7 MB of declared `.reloc` section holds just 108 bytes of genuine relocation data
Prior sighting	One host was reported by Huntress on 28 September 2026 in a campaign using ChatGPT Custom GPTs to steer victims to ClickFix lure pages
Vulnerability used	None. No CVE, no exploit and no zero-day vulnerability appears anywhere in the chain
Open questions	Operator unknown; Forescout reports no evidence of a link to the RomulusLoader named by Proofpoint, cannot confirm the `novatrafficcore[.]lol` association, and could not explain five `.bin` files the final binary never references

Two routes out of one panel

Both routes begin identically. The victim, talked into opening a Run dialog by a fake verification prompt, executes a PowerShell command that fetches a stager from /s/<token>. The stagers come from a shared template, rebuilt at runtime from an array of negative integers and executed through [scriptblock]::Create. Each deletes itself on the way out.

Route A downloads the Stardock-branded MSI over TLS 1.2, clears the mark-of-the-web with Unblock-File and installs silently with msiexec /i /qn /norestart. Of the seven components it drops, only the signed Stardock executable is genuine. Forescout notes the chain matches what Huntress described in September.

Route B is the more inventive half. The stager hides its console window through dynamically resolved GetConsoleWindow and ShowWindow calls, pulls a 7-Zip archive from orbitflownetwork[.]lol and the genuine 7zr.exe from GitHub, checks both file headers, then extracts with a hardcoded password. Inside is another archive, a second password file, five unexplained blobs and the carrier. Using a real 7-Zip binary is the point: on a telemetry timeline the step reads as routine administration.

Forescout's official wordmark. Its Vedere Labs research arm documented ROMULUS after finding a panel during an unrelated incident investigation.

The 842 MB file that is mostly nothing

Roughly 881.7 MB of the carrier is a declared relocation section containing a repeating sixteen-byte value and 108 bytes of real data; everything meaningful lives in a prefix of about 2 MB. Because the padding compresses almost perfectly, the archive stays under a megabyte in transit and only becomes enormous on disk.

That asymmetry is engineered. Multi-hundred-megabyte files blow past upload ceilings on analysis services, exhaust sandbox budgets and get skipped by scanners with a maximum file size. The attacker pays a few hundred kilobytes of bandwidth; the defender pays a timeout. The same trade runs through the three stages of AES-256 and byte-reversal that follow.

Why this is a DNS security problem

Work backwards and ask which defence could have fired. Email filtering never saw anything: the lure is a web page. Application allow-listing is weak, because PowerShell and msiexec are signed Microsoft binaries and 7zr.exe came from GitHub. Patching is irrelevant. Every perimeter control was bypassed not by cleverness but by sequence: ClickFix puts the human first, and once a user has pasted a command into the Run box, everything in front of the user has already been passed.

What remains is the network, and specifically the moment each hop has to be found. The stager hop needs no lookup, because the decimal-encoded address is the destination. The archive hop does: orbitflownetwork[.]lol must resolve before a single byte of that 842 MB carrier arrives, as must smashshape[.]com every time LegionLoader reports in. The named hops sit after the unnamed one, so resolver policy does not prevent the intrusion — it interrupts it, between the stager running and the payload landing.

That window is narrow but real, and cheap to hold. Resolving a hostname costs the same whether the file behind it is one kilobyte or nine hundred megabytes — precisely the budget ROMULUS cannot inflate. A protective resolver declining newly registered and novelty top-level domains would have stopped Route B at the archive. A DDoS attack trips every alarm an organisation owns within seconds; this chain is designed to trip none, yet the resolver log is one place it must leave a mark.

One caveat, plainly. If the malware resolves over DNS over HTTPS straight to a public endpoint, it never consults the configured resolver and the policy never applies. That argues for enforcing resolution at the gateway and knowing which resolver each managed host actually uses — and why checking the setting on the Windows hosts in your estate is worth the afternoon.

Data centre racks and network cabling representing the rented server infrastructure and cloud security exposure behind ROMULUS delivery panels — A representative data centre aisle with structured network cabling, photographed at a research computing facility in 2011 — not infrastructure linked to this campaign. ROMULUS panels were found on six rented hosts.

Practical steps for IT security teams

Alert on decimal-notation URLs. Forescout highlights eight-to-ten digit decimal addresses in command lines as high-signal and low-noise. Legitimate software effectively never does this.
Hunt the PowerShell shape, not the payload. A command combining -NoProfile, -ep bypass or -w hidden with a URL, or a long script run from %TEMP%, is common to both routes.
Flag silent MSI installs. msiexec /i ... /qn /norestart from %TEMP% paired with Unblock-File is worth reviewing every time.
Apply reputation policy at the resolver. Blocking newly registered and low-reputation top-level domains is the highest-yield IT security control against delivery chains that rotate hostnames faster than signatures follow.
Log resolution centrally and keep it. Query logs survive a wiped endpoint, and a lookup for a C2 hostname is often the only durable record a host was involved.
Rotate browser credentials. LegionLoader targets Chrome's stored secrets: assume saved passwords and session cookies are gone.

DNS Benchmark Pro results ranking public resolvers by DNS server performance for teams adding protective filtering policy — Resolver rankings by **DNS server performance**. Filtering policy only survives contact with users if the resolver enforcing it is fast enough that nobody looks for a way around it.

Network latency comparison across public DNS resolvers, a network diagnostic tool for validating protective DNS and DNS over HTTPS endpoints — Per-resolver **network latency** distribution, including **DNS over HTTPS** endpoints. A resolver benchmark is the quickest **network diagnostic tool** for confirming a protective resolver is the one actually answering your clients.

Industry impact

ROMULUS matters less as malware than as a sign of how delivery has been commoditised. Forescout cannot say whether this is a private tool, a commercial service, an affiliate framework or code passed around — and that uncertainty is the finding. A panel with a login page, per-campaign tokens and a country-level dashboard is infrastructure built for tenants. The same reasoning that made legitimate commercial software an attractive payload earlier this month applies to the delivery layer: standardise it, rent it out, let affiliates supply the lures.

It also closes off a comfortable assumption. The implicit model of intrusion has long put a vulnerability near the start, making patch cadence a reasonable proxy for exposure. Nothing here fits that model: a programme measuring itself purely on zero-day vulnerability response time would score this campaign at zero risk while it ran. The defences that actually engage are the ones watching behaviour and naming, and those never produce a satisfying remediation number.

The practical conclusion for DNS security is modest and worth acting on anyway. The six panels sat on ordinary rented server infrastructure, and the cloud security posture of those hosts was never the issue; they were simply reachable, and their names and addresses were the only part of the operation the attacker had to publish. Delivery platforms rotate hostnames because hostnames are what gets burned, and that churn is what a resolver is positioned to see. Teams that treat DNS security as an access-control surface rather than a lookup service get a checkpoint that works where everything upstream has already been skipped — which, increasingly, is most attacks.

Sources

Browse every DNS news article by month →

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: Forescout Vedere Labs — ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform (2026-10-15).