Hackers Abuse FTP Server Banners to Deliver New Windows Malware

Severity
Medium

Detail

Threat actors are abusing FTP server banners to conceal commands used to deliver two previously undocumented remote access trojans (RATs), named E4del and PINHOLE. MalwareHunterTeam observed the technique in July 2026 during an attack involving Windows shortcut files (.LNK) and FTP server banners used as dead-drop resolvers (DDR) to retrieve commands. SOCRadar subsequently expanded its investigation and found that the technique remained active, with new infrastructure observed as recently as August 2026.

FTP banners are text messages displayed by an FTP server when a system connects, before authentication. In this campaign, attackers embed commands within these initial server responses so that malware running on a compromised system can retrieve instructions from the FTP server.

The observed attacks begin with a ZIP archive that triggers an LNK-based infection chain. The initial compromise is believed to occur through phishing. The infection chain delivers E4del and PINHOLE through two separate routes, with both malware families retrieving a PowerShell script from FTP banners.

How?

The attack begins with a ZIP archive that launches an LNK-based infection chain, with phishing considered the likely initial access method. The infection chain uses FTP server banners as dead-drop resolvers. When the compromised system connects to the FTP server, the server’s initial banner response contains commands that allow the malware stager to retrieve instructions.

E4del is a Node.js-based RAT packaged within a digitally signed Electron application designed to appear as Discord. It can execute commands through persistent or temporary shells, capture screenshots, stream the desktop through WebSockets, and download and execute additional payloads. E4del also uses a Node.js module named crypto32.node that attempts privilege escalation. However, researchers were unable to retrieve the module for analysis.

PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions. The malware uses shellcode fluctuation to maintain a small memory footprint, keeping only one 4KB section of the payload in memory at a time. The final assembly is injected into a suspended ApplicationFrameHost.exe process through Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, file uploads and downloads, command execution, process management, screenshot capture, and deployment of a module designed to steal credentials stored in browsers.

Impact

E4del provides attackers with remote access capabilities, including command execution, screenshot capture, desktop streaming, and downloading and executing additional payloads. PINHOLE provides capabilities for file enumeration, file transfer, command execution, process management, screenshot capture, and browser credential theft. PINHOLE’s use of Pinterest pins and SurveyMonkey survey questions for C2 configuration provides flexibility and resilience against infrastructure takedowns.

The malware also attempts to minimize its footprint through shellcode fluctuation and Early Bird APC injection. At the time of analysis, the PINHOLE script had recorded only 11 execution events, indicating that the campaign was still in an early stage.

Conclusion

Threat actors are using FTP server banners as an alternative dead-drop resolver to deliver commands and deploy the E4del and PINHOLE RATs. The technique has been observed since early July 2026 and remained operational through August 2026. While the approach provides a novel method for delivering malicious commands, SOCRadar noted that FTP connections to unknown servers may be more noticeable than traffic to commonly used legitimate web services such as X, GitHub, or YouTube. The technique is also considered versatile and could potentially be adapted for ClickFix social engineering campaigns.

Source

https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/
https://socradar.io/blog/ftp-banners-new-dead-drop-resolver-rats/