Threat actors are using FTP server banners to hide commands that deliver two previously undocumented remote access trojans, named E4del and PINHOLE, according to a report from threat intelligence platform SOCRadar. The technique, first observed by MalwareHunterTeam in July, uses the greeting message an FTP server sends to connecting hosts before login as a dead-drop resolver to retrieve instructions. SOCRadar expanded its investigation using FOFA searches and determined the method has been weaponized since early July 2026 and remains operational, with new infrastructure seen as recently as August 2026.
The attacks begin with a ZIP archive that triggers an infection chain based on shortcut files, or LNK files, and the initial compromise likely occurs through phishing, the researchers said. Two distinct infection routes deliver the RATs, with both retrieving a PowerShell script embedded in FTP banners. E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord. This malware supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads.
SOCRadar also noted a Node.js module named crypto32.node that attempts privilege escalation, but the researchers could not retrieve it for analysis. PINHOLE takes a different approach, retrieving its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions, a tactic that provides versatility and resilience to take-downs. The malware leaves a minimal footprint on the host, using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time, and injecting the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers.
At the time of analysis, the PINHOLE script counted only 11 execution events, suggesting the campaign was in an early stage. While abusing FTP banners is a novel alternative for command delivery, SOCRadar said the approach is less stealthy than traditional web-based dead-drop resolvers, such as those using X, GitHub, or YouTube, because FTP connections to unknown servers are more likely to stand out. The researchers noted that threat actors typically use legitimate web services to provide cover through high-volume, expected network traffic, but FTP banners represent a new option. They added that the technique is very versatile and could easily be adapted for ClickFix social engineering campaigns.
The SOCRadar report provides indicators of compromise that could help defenders identify the malicious infrastructure and infected machines on their networks. The researchers emphasized that overall prevention scores can hide what happens after initial access, as once attackers use valid credentials, prevention drops sharply. Their Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments, offering a granular view of where security controls fail. For US technology professionals, this highlights the need to monitor for unusual FTP connections and to scrutinize outbound traffic patterns beyond standard web services.
More cybersecurity news from TechManNews.
