- Engineer — Plan: Siemens Software Center is niche industrial software, but the DLL sideloading vector with a public PoC and active exploitation warrants a check: audit whether Siemens Software Center is present in your estate and patch to the fixed version; the ClickFix delivery chain also means reviewing write-access to directories alongside software installs.
- SOC/IR — Act: An active ClickFix campaign is deploying RATs via DLL sideloading in Siemens Software Center directories — hunt for ClickFix lure artifacts (clipboard-hijack/fake CAPTCHA precursors), anomalous DLL loads from Siemens app paths, and RAT beaconing behavior since the campaign was disclosed.
- Leader — Learn: Active RAT deployment via social engineering against industrial software management tooling is worth noting for OT/manufacturing-sector risk registers, but this is not a systemic event requiring immediate leadership action unless Siemens software is confirmed in your environment.
- Signals: CVE-2026-110936 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub