"By utilizing FOFA searches, we determined that this technique has been weaponized since early July 2026 and remains operational, with new infrastructure observed as recently as August 2026," SOCRadar told BleepingComputer.
How FTP banners were used as dead-drop resolvers
Researchers observed an unusual technique in which attackers embed commands in FTP server banners — the greeting text sent to connecting hosts before login — and use those banners as dead-drop resolvers (DDRs). MalwareHunterTeam first observed the method in July during an attack that used ZIP archives and Windows shortcut files (.LNK) to trigger an infection chain that retrieves commands from FTP banners.
In the observed campaigns the infection chain delivered a PowerShell script retrieved directly from FTP banner text. SOCRadar expanded the hunt after the initial discovery and found the approach in active use through August 2026, using FOFA searches to map the infrastructure.
E4del: an Electron-packaged, Node.js RAT
One of the two remote access trojans delivered by the chain is named E4del. SOCRadar reports that E4del is Node.js–based and is packaged inside a digitally signed Electron application that masquerades as Discord. The RAT supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads.
SOCRadar also identified a Node.js module called crypto32.node that attempts privilege escalation; researchers were unable to retrieve that module for further analysis.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePINHOLE: Pinterest and SurveyMonkey used for C2, and a small-memory footprint
The second RAT, PINHOLE, retrieves its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions, a tactic SOCRadar described as offering versatility and resilience to take-downs. PINHOLE is designed to leave a minimal footprint on the host: it uses shellcode fluctuation so that only one 4KB section of payload is resident in memory at a time.
To activate its final assembly, PINHOLE injects into a suspended ApplicationFrameHost.exe process using Early Bird APC injection. The RAT supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module to steal credentials stored in browsers. At the time of SOCRadar's analysis, the PINHOLE script counted only 11 execution events, suggesting the campaign was at an early stage.
Why attackers picked FTP banners — and the trade-offs involved
SOCRadar characterizes FTP banners as a "novel alternative" to the familiar practice of hiding DDRs on high-volume web services. The researchers contrasted FTP banners with established web-based DDRs hosted on services such as X, GitHub, and YouTube, noting that those services provide cover through expected, high-volume traffic. FTP activity to unknown servers is more likely to stand out, making the FTP-banner approach less stealthy than web-based alternatives.
At the same time, SOCRadar warned the technique is versatile; it can be adapted to different social-engineering lures and could "easily" be used in ClickFix-style campaigns, according to the report shared with BleepingComputer.
What this means for technologists, security teams, and enterprises
- Technologists and security teams: SOCRadar's report includes indicators of compromise that can help identify malicious infrastructure and infected hosts. Teams should be aware that PowerShell scripts and LNK-based chains can leverage FTP-banner text as a delivery mechanism and that such FTP connections may be anomalous.
- Enterprises and procurement leaders: The campaign demonstrates that attackers are experimenting with alternative DDR channels and packaging malware in digitally signed, legitimate-appearing applications. Buyers and defenders should note that appearance of valid signatures or familiar application wrappers does not preclude malicious behavior.
- Operational defenders and incident responders: The PINHOLE behavior — a tiny in-memory footprint, Early Bird APC injection into ApplicationFrameHost.exe, and use of social platforms for C2 — suggests detection signatures will need to span both network telemetry (for unusual FTP connections and external queries to Pinterest/SurveyMonkey) and host behavior (memory patterns and suspicious process injection).
Indicators, prevention observations, and the Blue Report 2026
SOCRadar provides indicators of compromise in its report to assist defenders in identifying malicious infrastructure and infected machines. The researchers also highlighted a broader operational point: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." This observation sits alongside the Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments.
The immediate takeaway is crisp: threat actors have taken an uncommon channel — FTP banners — and weaponized it as an alternate DDR technique, coupling it with LNK-based stagers and two distinct RAT families. Defenders now have indicators to hunt; whether detection and response workflows incorporate FTP-banner anomalies, application signing context, and the specific injection behaviors described will shape how quickly these campaigns are identified and contained.
Source: BleepingComputer — Hackers abuse FTP server banners to deliver new Windows malware
