Malware News Threat actors found a new place to hide C2 commands: FTP banners. SOCRadar's STRU traced this to two undocumented RATs — E4del and PINHOLE.

[Khushal]

Content source

https://socradar.io/blog/ftp-banners-new-dead-drop-resolver-rats/

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

During an investigation, the SOCRadar Threat Research Unit (STRU) identified the active abuse of FTP banners as DDRs to distribute malicious commands...

socradar.io

Security products have become increasingly effective at detecting suspicious commands used for malware delivery. Consequently, threat actors are adopting more creative methods to bypass these defenses, such as utilizing Dead Drop Resolvers (DDRs): alternative locations, including legitimate web services or protocols, used to acquire malicious strings, Command and Control (C2) configurations, or commands.

During an investigation, the SOCRadar Threat Research Unit (STRU) identified the active abuse of FTP banners as DDRs to distribute malicious commands, a technique observed in the wild since early July 2026. Further infrastructure analysis led to the discovery of two previously undocumented Remote Access Trojans (RATs), which we have named E4del and PINHOLE.

Key Points​

• STRU discovered active abuse of FTP banners as DDRs, allowing malware stagers to fetch commands directly from the protocol’s initial response.
• While currently observed in malicious LNK files, this technique is highly versatile and easily adaptable for “ClickFix” social engineering campaigns.
• FTP-based DDRs were found delivering two previously undocumented RATs: E4del and PINHOLE, tracked as separate clusters.
• E4del is a modular, Electron-based RAT offering eight specialized commands, such as live desktop streaming, screenshot capture, and privilege escalation.
• E4del’s beaconing mechanism implements a tiered jitter system, dynamically transitioning between three distinct states (Active, Semi-Active, Inactive) based on the elapsed time since its last received task.
• PINHOLE is a sophisticated multi-stage RAT with fourteen distinct command types, including browser credential theft, file upload/download, and screenshot capture.
• To evade detection, PINHOLE employs Halo’s Gate and Early Bird APC Injection. Additionally, it leverages legitimate platforms like Pinterest and SurveyMonkey to resolve its C2 while proxying its traffic through Cloudflare Workers.
• PINHOLE operators also maintain an “FTP Stats Panel” to track script execution and IP addresses connected to their infrastructure.

 

[Bot]

Key Defensive Takeaway

The technique described is notable because the FTP banner is being used as a command-delivery channel rather than merely as service metadata. A stager can connect to an attacker-controlled FTP server, read the initial banner, and treat selected text as configuration or instructions. This may bypass detections that focus only on conventional HTTP-based command retrieval.

The important indicators are therefore not limited to the reported RAT names. Defenders should also monitor for:

• Unexpected outbound FTP connections, especially from user workstations or Office-related processes.
• LNK files that launch scripting engines, Electron applications, PowerShell, or unusual command interpreters.
• Processes connecting to FTP services and immediately parsing or retrieving the server greeting.
• Abnormal use of Pinterest, SurveyMonkey, Cloudflare Workers, or other legitimate services for configuration resolution.
• Suspicious process injection behavior, including Early Bird APC Injection.
• Unexpected browser credential access, screenshot activity, desktop streaming, or bulk file transfers.

Recommended Mitigations

• Block outbound FTP where it is not required, preferably at the firewall, secure web gateway, and endpoint levels.
• Apply application control to restrict execution of LNK files from email attachments, downloads, temporary directories, and network shares.
• Enable endpoint detection rules for suspicious child processes spawned by Windows Explorer or shortcut files.
• Use DNS, proxy, and endpoint telemetry to correlate unusual connections to newly registered or low-reputation infrastructure.
• Review Cloudflare Worker and legitimate-platform traffic in context rather than treating those services as inherently malicious.
• Submit suspected samples and URLs to reputable security vendors or VirusTotal, while avoiding the upload of confidential files.

The article’s technical claims and malware classifications should be confirmed against the original report, independent analysis, and available samples. Even without attributing an intrusion to E4del or PINHOLE, the broader defensive lesson is clear: protocol metadata and legitimate third-party services can be abused as low-visibility command-resolution channels.