Analysis of ROMULUS ClickFix Delivery Platform

ROMULUS is a recently identified multi-payload delivery platform that leverages 'ClickFix' social engineering lures to compromise victims. The platform serves a wide array of malware including LegionLoader (also known as Satacom), Atlas RAT, and various loaders. It is characterized by its use of dark-themed authentication panels and reusable backend endpoints for staging PowerShell scripts and trojanized MSI installers. While researchers have identified overlaps with the Chinese-speaking threat actor TA4922 (also known as Silver Fox or Void Arachne), ROMULUS appears to be a distinct or shared infrastructure used for both cybercriminal and potentially espionage-aligned objectives.

The attack chain typically begins with localized lures themed around HR, payroll, or technical fixes (ClickFix) that prompt users to execute malicious code. Technical sophistication is evident in the platform's use of decimal IP notation for C2 communication, binary padding to inflate executables beyond sandbox limits (reaching ~880MB), and modular malware architectures like Atlas RAT. The campaign has expanded globally from its initial focus on East Asia to include targets in Europe and Africa, demonstrating high operational tempo and rapid evolution of TTPs.