"malware stagers to fetch commands directly from the protocol's initial response," SOCRadar warned — an apt summary of a novel trick now observed in active campaigns that turns FTP server banners into dead drop resolvers (DDRs) for two newly documented remote access trojans, E4del and PINHOLE.
How FTP banners are being repurposed as dead drops
Researchers report that attackers have begun embedding executable commands inside the plain-text welcome messages an FTP server sends immediately upon connection. The tactic — first highlighted by MalwareHunterTeam and analyzed in detail by SOCRadar — lets a small first-stage payload connect to an FTP server, read the banner, and treat that banner as the next-stage command. That command can then instruct the victim host to retrieve additional payloads from WebDAV, Cloudflare-hosted URLs, or other services.
SOCRadar notes the technique is less stealthy than web-based DDR use because "security controls are likely to flag FTP connections to unknown servers as anomalous." Nonetheless, the approach offers attackers a direct channel to deliver scripted commands without hosting obvious C2 endpoints in the bait payload itself.
E4del: a Node.js RAT embedded in a signed Electron app
One observed chain begins with Spanish-language voucher-claim lures that trick targets into running a Windows Shortcut (LNK). That shortcut retrieves a next-stage command from an FTP banner at 157.254.194[.]31:21, which in turn fetches a second banner at 167.148.41[.]164:21. The resulting command launches PowerShell to download, extract, and run a binary from a ZIP via WebDAV, ultimately executing a DLL export through rundll32.exe and conhost.
The final payload in this chain is E4del: a Node.js-based RAT embedded inside a digitally signed Electron application masquerading as Discord. SOCRadar describes E4del as supporting defense evasion, persistence, system fingerprinting, and encrypted C2 communications capable of delivering an interactive reverse shell, screenshots, live desktop streaming, file download, and follow-on payloads. Its beaconing is "highly dynamic," employing a tiered jitter system that transitions E4del through three states: an Active mode in the first 20 seconds with check-ins every 200 ms to 2 s; a Semi-Active mode after 20–40 seconds with 2–5 s intervals; and an Inactive mode after 40 seconds with 5–9 s check-ins.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePINHOLE: multi-stage unpacking, APC Injection, and a 14-command RAT
PINHOLE is assessed as the more advanced actor of the two. SOCRadar found an FTP banner at 209.99.185[.]38:21 containing commands that used the MSXML2.XMLHTTP COM object within PowerShell to pull a secondary script from hxxps://cloudflare.milicare[.]in/app/c. That script is written to %TEMP%u.cmd, executed, and deleted to reduce footprint. The dropper presents a wrapper claiming to be an update utility from "Weston Computing Systems Ltd" and uses Halo's Gate and Early Bird APC Injection techniques to bypass security products and run payloads inside suspended legitimate processes.
KPMG Israel's explainer — cited in the reporting — breaks down the method: attackers create a child process in a suspended state, inject shellcode, and use asynchronous procedure calls to execute it, evading many AV and EDR heuristics. PINHOLE unpacks through six layers to extract a 119 KB native x86-64 executable that implements RAT functionality and communicates with C2 over HTTP GET and POST. SOCRadar reports the RAT implements 14 commands to enumerate files, exfiltrate and upload files, execute binaries, search recursively, delete files, list and terminate processes, take screenshots, run PowerShell commands, and initialize a PowerShell session via anonymous pipes; the campaign also attempts to retrieve a browser-stealer module of unspecified form.
Operational infrastructure and early campaign telemetry
Researchers tied the campaign to additional infrastructure and social-engineering styles previously observed in ClearFake campaigns. Microsoft and Gen Threat Labs have reported similar WebDAV and ClickFix-style fake CAPTCHA lures used to distribute WordlistLoader and Amatera Stealer, and SOCRadar notes attackers behind PINHOLE are leveraging high-reputation platforms such as Pinterest and SurveyMonkey as indirect DDRs while proxying traffic through Cloudflare Workers.
Operational telemetry includes a dedicated "FTP Stats Panel" hosted at 69.48.228[.]126:5000 that lets operators track script executions, total connections, and unique IPs. At the time of analysis the panel showed only 11 execution events — a sign, SOCRadar says, that the campaign was still in its infancy.
What this means for technologists and affected enterprises, and for end users
- Technologists and security teams: watch for anomalous FTP session initiation to unfamiliar servers and prioritize inspection of protocol banners in threat hunting. The multi-stage unpacking and APC Injection described for PINHOLE indicate detections should include monitoring for unusual child-process creation, process suspension followed by code injection, and deleted temporary command scripts such as %TEMP%u.cmd.
- Affected enterprises and procurement leaders: third-party trust signals — digitally signed Electron apps, or claims of benign update utilities — can be abused. Procurement and software whitelisting controls should be validated against forged or misattributed installers, and controls around WebDAV and Cloudflare-hosted callbacks should be revisited.
- End users and the general public: the initial vectors reported include shortcut-file phishing and ClickFix-style fake CAPTCHA decoys. Users should treat unsolicited voucher offers or CAPTCHA prompts with caution and avoid executing unexpected LNK files.
The creative turn to FTP banners does not make the operators invisible — it does, however, show an appetite for blending simple network services with multi-stage, aggressive unpacking and process-injection techniques. With PINHOLE's unpacking layers, APC Injection and a dedicated stats panel, and E4del's jittered beaconing and Electron-based packaging, defenders have concrete artifacts to chase but also a reminder: small protocol fields can carry big surprises. The original reporting is available here: https://thehackernews.com/2026/08/e4del-and-pinhole-rats-turn-ftp-banners.html
