Researchers have uncovered a novel cyberattack campaign in which threat actors are abusing FTP server banners—normally just brief greeting messages—to deliver commands for two newly identified Remote Access Trojans (RATs) called E4deland PINHOLE. This marks the first documented instance of FTP banners being used as dead-drop resolvers (DDRs) to fetch malware instructions. The discovery was made by SOCRadar’s Threat Research Unit after anomalies detected by MalwareHunterTeam.
FTP banners are responses sent by FTP servers immediately after a client connects but before authentication. In this campaign, malicious actors embed commands in those banners. Once a user opens a ZIP file—typically received via phishing—which contains a disguised Windows shortcut (.LNK), the shortcut reads the FTP banner and extracts commands embedded there. These dictate further actions such as downloading payloads via WebDAV, executing DLL exports using rundll32.exe, or launching PowerShell scripts.
E4del: Electron-App Disguised, Signed, & Dangerous
E4del is a Node.js-based RAT bundled inside an Electron application that masquerades as Discord. It leverages a legitimately signed Discord.exe to appear trustworthy, while its app logic—packaged within resources/app.asar—is replaced with malicious code. It supports features like system fingerprinting, defense evasion, encrypted C2 communication, interactive reverse shell access, screenshot capture, live desktop streaming, file transfers, and loading additional payloads.
The command check-in mechanism for E4del is tiered. For the first 20 seconds after a task arrives, it polls rapidly (every 200 milliseconds to 2 seconds). If no new commands appear within 20–40 seconds, it slows down to 2–5 second intervals. Beyond 40 seconds without new tasks, it enters an “inactive” mode, drawing out check-ins to every 5–9 seconds. This jittered timing helps it blend with normal traffic.
PINHOLE: Low Footprint & Multi-Stage Craft
PINHOLE displays more operational sophistication. It sources its control server details not hard-coded, but through legitimate high-reputation platforms: Pinterest pins and SurveyMonkey survey questions. These act as second-tier dead-drop sources. After that, it proxies communication using Cloudflare Workers.
The malware installs itself to a random directory under %LOCALAPPDATA%/Packages, sets up persistence via Windows registry, and stores configuration data in NTFS alternate data streams attached to desktop.ini files. It then injects its payload into a suspended process (ApplicationFrameHost.exe) using Early Bird APC injection after several layers of unpacking. PINHOLE supports 14 commands including file operations, process management, screenshot capture, running binaries, and retrieving a browser credential stealer module.
Notably, at the time of analysis, the PINHOLE campaign had only 11 recorded executions, suggesting it is in early stages.
Why This Matters for Security Teams
This tactic of embedding commands in FTP banners is creative, but not entirely stealthy—FTP connections to unfamiliar servers are more detectable than standard web-based command delivery through high-traffic domains. Still, many defenses don’t inspect FTP banner content, treating it as innocuous metadata rather than payload carrier.
Defenders are advised to monitor for ZIP-based phishing with `.LNK` shortcuts, suspicious use of outbound FTP control connections, escalations of privileges via unsigned or mismatched application bundles (like signed Discord.exe with modified resources), and abnormal injection behavior, especially involving legitimate system processes.
As FTP banner abuse expands the toolkit of threat actors, it underscores a larger trend: using legitimate, high-reputation platforms and unexpected protocol features to hide malicious command-and-control (C2) infrastructure. As defenders build new detection strategies, the old assumptions about what traffic is “safe” need reevaluation. Companies should inspect pre-authentication banner data where feasible, restrict unexpected protocol use, and validate the integrity of signed applications—not just the signature, but the entire application behavior.
