Attackers abuse genuine Siemens Software Center to infect Windows PCs

SecurityWeek ICS/OTSiemens

What happened. Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLL files to infect Windows PCs. They used ClickFix lures, which trick users into running commands themselves.

Who is affected. Windows PCs running Siemens Software Center. The source does not say which organisations or sectors are affected.

What to do. Check whether Siemens Software Center is installed on your Windows PCs, and treat those endpoints as at risk until you have reviewed them.

Editor's reading

Purdue level: L4
L3
L2
Level 4, enterprise IT; Level 3, site operations; Level 2, supervisory control (HMIs, SCADA, engineering workstations)
If you cannot fix it yet: Restrict installation and execution of Siemens Software Center to approved engineering and administration hosts.
Allowlist applications so unknown DLLs cannot load alongside signed executables.
Brief staff not to paste or run commands from web pages or pop-ups.
Watch for: Signed Siemens Software Center executables loading unexpected DLLs from user-writable or unusual folders.
Commands pasted into the Windows Run dialog or a terminal shortly before Siemens Software Center starts.

Inferred from the facts above, not stated by the source. Check it against your own site before acting.

Source: SecurityWeek ICS/OT (opens securityweek.com)