Threat actors have recently adopted an intriguing method of exploiting FTP banners to conceal commands that deploy two previously undocumented remote access trojans (RATs) known as E4del and PINHOLE. This innovative approach was first observed by MalwareHunterTeam in July, during an attack that utilized shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve malicious commands.
Unveiling the Technique
FTP banners, which serve as greeting messages for connecting hosts prior to login, have been ingeniously repurposed by malware stagers. By embedding commands within the initial response sent from a compromised system to an FTP server, attackers can effectively receive instructions from a remote server.
Following the discovery of this technique, researchers at the threat intelligence platform SOCRadar expanded their investigation and confirmed that the method remains active. “Through FOFA searches, we established that this technique has been weaponized since early July 2026 and continues to be operational, with new infrastructure identified as recently as August 2026,” they reported.
According to SOCRadar, the observed attacks typically commence with a ZIP archive that initiates an LNK-based infection chain. The researchers suggest that the initial compromise is likely facilitated through phishing tactics.
Source: SOCRadar
The infection chain subsequently delivers the two RATs, E4del and PINHOLE, through distinct routes, both of which involve retrieving a PowerShell script from FTP banners.
E4del is characterized as a Node.js-based RAT, cleverly disguised within a digitally signed Electron application that mimics Discord. This RAT boasts a range of capabilities, including executing commands through persistent or temporary shells, capturing screenshots, streaming the desktop via WebSockets, and downloading and executing additional payloads. Notably, SOCRadar also identified a Node.js module named crypto32.node that attempts privilege escalation, although it could not be retrieved for further analysis.
Source: SOCRadar
On the other hand, PINHOLE retrieves its command and control (C2) configuration from Pinterest pins and SurveyMonkey survey questions, a tactic that enhances its versatility and resilience against takedowns. This malware is designed to leave a minimal footprint on the host, employing shellcode fluctuation to maintain only a single 4KB section of the payload in memory at any given time. It injects the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection.
PINHOLE supports an array of 14 commands, which include file enumeration, file uploads and downloads, command execution, process management, screenshot capturing, and a module for stealing credentials stored in browsers.
Source: SOCRadar
At the time of analysis, the PINHOLE script had recorded only 11 execution events, indicating that the campaign is still in its nascent stages.
While the use of FTP banners to deliver commands represents a novel alternative, SOCRadar cautions that this method is less stealthy compared to traditional web-based DDRs such as X, GitHub, or YouTube. FTP connections to unknown servers tend to be more conspicuous.
“Threat actors typically leverage legitimate web services to provide cover through high-volume, expected network traffic, but FTP banners present a fresh alternative,” the researchers noted. They also highlighted the versatility of this technique, suggesting it could be easily adapted for ClickFix social engineering campaigns.
SOCRadar’s report includes indicators of compromise that could assist defenders in identifying malicious infrastructure and infected machines within their networks.
