Threat actors are leveraging FTP server banners as dead-drop resolvers to deliver two undocumented remote access trojans, E4del and PINHOLE, via sophisticated infection chains.
- Attackers are using FTP server 'banners' to hide malicious commands.
- Two new Remote Access Trojans (RATs), E4del and PINHOLE, have been identified.
- The infection typically begins with phishing and .LNK file execution.
In a sophisticated shift in cyberattack tactics, threat actors are now abusing FTP server banners to act as dead-drop resolvers (DDR). By embedding malicious commands within the text strings used by servers to greet connecting hosts, hackers can deliver instructions to infected systems without using traditional, highly-monitored web services like GitHub or YouTube. This technique has been observed delivering two previously undocumented remote access trojans (RATs) known as E4del and PINHOLE.
The Anatomy of the Infection Chain
According to research from SOCRadar and MalwareHunterTeam, the attack vector often starts with a deceptive ZIP archive. Once opened, it triggers an infection chain involving .LNK (shortcut) files. These files are designed to execute PowerShell scripts that reach out to an FTP server. Instead of downloading a file directly, the malware reads the server's 'greeting' message—the banner—to extract its next set of commands.
Deep Dive: E4del vs. PINHOLE
The investigation revealed two distinct malware strains with different operational methodologies:
| Feature | E4del RAT | PINHOLE RAT |
|---|---|---|
| Base Technology | Node.js / Electron | Shellcode / PowerShell |
| Masquerade | Disguised as Discord | Minimal footprint |
| C2 Mechanism | Persistent/Temporary Shells | Pinterest & SurveyMonkey |
| Key Capability | Desktop Streaming & Screenshots | Credential Stealing & File Management |
E4del is particularly deceptive, packaged inside a digitally signed Electron application that mimics Discord. It allows attackers to stream desktops over WebSockets and execute additional payloads. On the other hand, PINHOLE is designed for extreme stealth. It retrieves its configuration from legitimate sites like Pinterest and SurveyMonkey, making its traffic look like normal user activity. It also uses 'Early Bird APC injection' to hide within legitimate processes like ApplicationFrameHost.exe.
Why This Matters
BozokMedia analysis shows that while this technique is less stealthy than using high-traffic platforms like YouTube, it represents a highly versatile alternative for attackers. By moving away from common web-based DDRs, hackers can bypass security filters that specifically look for malicious activity on mainstream social media or code-sharing sites. This evolution suggests that attackers are constantly seeking 'novel alternatives' to maintain persistence.
The use of FTP banners as a command delivery mechanism marks a creative pivot toward exploiting legacy protocols to bypass modern web-centric security monitoring.
Frequently Asked Questions
1. How can I protect my organization from this specific attack?
Implement strict policies against executing unknown .LNK files and monitor for unusual FTP connections from internal workstations to unknown external IPs.
2. Is this a widespread attack?
While researchers noted the PINHOLE script had few execution events, indicating an early stage, the technique is highly adaptable and could see wider use in social engineering campaigns.
