ROMULUS is the name used for reported delivery infrastructure associated with multiple malware payloads and exposed control panels. It is infrastructure, not a specific malware family: operators can use delivery systems to host or distribute different files and to support different routes or lures.
For defenders, this distinction matters because infrastructure can connect otherwise separate samples and campaigns, while its reuse can complicate attribution. In the reported context, researchers linked a LegionLoader delivery chain to ROMULUS and identified exposed panels; that does not by itself establish who operated them or prove that a particular scanner was bypassed. Security teams can investigate related domains, IP addresses, download activity, and file behavior, while treating exposed infrastructure as a lead rather than proof of compromise.