The link in the email pointed at an image file. The web server sent back a program. What arrived on two separate customer networks was a one megabyte Windows executable named image.pif, and in both cases somebody double clicked it.
The extension is the trick, and an old one. A .pif is a program information file, a leftover from the DOS era, and Windows still runs it as a program whatever the extension implies or the icon shows. Renamed to .exe, its properties sheet gives up forged details claiming it belongs to a security product it has nothing to do with.
The interesting part is what is missing
Everything downstream of that file is textbook DarkMe, a Visual Basic 6 spy trojan and remote access tool. Everything upstream is, in the words of the Huntress threat hunting team that found it, boring. There is no exploit in this campaign at all.
That is a change worth noting. DarkMe became well known in early 2024 for how it was delivered rather than for what it did. In 2023 it rode CVE-2023-38831, the WinRAR extension spoofing flaw, as a zero day dropped on trading forums, then moved to CVE-2024-21412, a Defender SmartScreen bypass staged over a WebDAV share. This time the initial access is a malspam email with a link in it. Huntress reads that as capable actors reaching for cheaper entry to cast a wider net.
The family was first observed in September 2021 and documented a year later by NSFOCUS as Operation DarkCasino, attributed to EvilNum. Trend Micro and SonicWall have tied it, with the usual caveats, to Water Hydra, an APT that chases money rather than secrets: forex traders, trading forums, gambling platforms and cryptocurrency users.
Windows Installer does the heavy lifting
The .pif has one job: invoke Windows Installer to fetch and run an installer package from an attacker registered domain, quietly and with no reboot. Real installers almost never sit alone in the root of an empty domain. This one was built with the exemsi MSI Wrapper under the cover name PrinterFind Softwares, and its only purpose is to expand a cabinet archive into the user's AppData directory and run a script.
That script writes a registry template, imports it to register a COM object, and fires the loader. The command that starts the final stage is the one defenders should care about: rundll32.exe with the /sta flag and nothing but an opaque identifier. That flag runs the object in a single threaded apartment, sidestepping detections keyed to the usual rundll32 syntax, and the malicious library's path never reaches the command line at all. Huntress saw the same command in the 2024 campaign, which makes it durable to hunt for.
From there the chain runs through three Visual Basic 6 loaders, each calling a named export in the next, and the last decrypts the payload and hollows out a signed binary to run it. All three report their language as Spanish, a small tell about whoever built them.
Hunt the loader, not the exploit
There is no patch here, because no vulnerability is being used, so detection is the whole defence. Alert on rundll32 launched with /sta and a bare identifier, on Windows Installer pulling a package from a remote HTTPS address in silent mode, and on a .pif executing anything at all. Blocking .pif at the gateway costs almost nothing. Indicators include hxxps://readonline365[.]com/view/image[.]png, hxxps://onlineview365[.]com/propi[.]msi and the sample hash 54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76.
For defenders who spent 2024 watching this group burn zero days, the downgrade is the story. A crew that once needed unpatched WinRAR and SmartScreen bugs now gets the same foothold from a mislabelled file and a double click, and reaches more people doing it. Our EvilNum profile tracks the longer history, and IntelFusions followed the same loader approach in AtlasRAT's chain.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.