Threat actors are employing a novel technique to deliver two previously undocumented remote access trojans (RATs), E4del and PINHOLE, by embedding malicious commands within FTP server banners. This unusual method was first observed in July 2026 by MalwareHunterTeam and subsequently investigated by researchers at SOCRadar, who confirmed its continued use into August 2026.
The attack chain typically begins with a ZIP archive, likely delivered via phishing, which triggers an LNK-based infection. These shortcut files then connect to an FTP server, where a malware stager retrieves further instructions from the server's greeting message, or banner. This allows the attackers to issue commands to compromised systems without relying on more conventional command-and-control (C2) channels.
E4del, one of the RATs delivered, is a Node.js-based application packaged within a digitally signed Electron framework, designed to masquerade as Discord. Its capabilities include executing commands via persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and running additional payloads. Researchers also noted a Node.js module named `crypto32.node` associated with E4del, which attempts privilege escalation, though it could not be retrieved for full analysis.
The second RAT, PINHOLE, demonstrates a sophisticated approach to C2 communication by retrieving its configuration from legitimate online services such as Pinterest pins and SurveyMonkey survey questions. This tactic enhances its resilience against takedowns and provides versatility. PINHOLE is designed to maintain a minimal footprint on the host, utilizing shellcode fluctuation to keep only a 4KB section of its payload in memory at any given time. It injects its final assembly into a suspended `ApplicationFrameHost.exe` process using an Early Bird APC injection technique.
PINHOLE supports 14 distinct commands, including file enumeration, uploading and downloading files, command execution, process management, screenshot capture, and the deployment of a module for stealing browser-stored credentials. At the time of analysis, the PINHOLE script had only 11 recorded execution events, suggesting the campaign was in its initial stages.
While the use of FTP banners for command delivery is a novel approach, SOCRadar researchers suggest it may be less stealthy than traditional web-based dead-drop resolvers (DDRs) that leverage high-volume, legitimate services like X (formerly Twitter), GitHub, or YouTube. This is because FTP connections to unknown servers are more likely to raise suspicion. Despite this, the technique is highly versatile and could be easily adapted for other social engineering campaigns, such as ClickFix.
SOCRadar has released indicators of compromise to assist defenders in identifying the malicious infrastructure and detecting infected machines within their networks.
