E4del and PINHOLE RATs Abuse FTP Banners as Dead Drop Resolvers

Cybersecurity researchers have uncovered a novel campaign that abuses FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) named E4del and PINHOLE. This marks the first time this technique has been observed in the wild, according to a technical report from SOCRadar.

FTP banners are welcome messages sent by FTP servers upon connection. The malware stagers fetch commands directly from the protocol’s initial response, allowing threat actors to embed malicious commands within the banner. While this method is less stealthy than traditional web-based DDRs, it represents a creative evolution in malware delivery.

In one attack chain, Spanish-language lures related to voucher claims trick users into executing a Windows Shortcut (LNK) file, which retrieves the next-stage command from an FTP banner. The command connects to a WebDAV server to download and execute a DLL via rundll32.exe. This WebDAV approach has also been linked to a ClearFake campaign distributing WordlistLoader and Amatera Stealer using ClickFix lures.

E4del is a Node.js-based RAT embedded in a digitally signed Electron application masquerading as Discord. It supports defense evasion, persistence, system fingerprinting, and encrypted C2 communication, enabling interactive reverse shell, screenshot capture, live desktop streaming, file download, and additional payload delivery. Its beaconing mechanism uses a tiered jitter system to blend in with normal traffic, transitioning between Active, Semi-Active, and Inactive states based on elapsed time since the last task.

PINHOLE is assessed to be more advanced, using high-reputation platforms like Pinterest and SurveyMonkey as DDRs to obtain C2 server details and proxy communication through Cloudflare Workers. The malware employs the Halo’s Gate technique to bypass security software and uses Early Bird APC Injection to run payloads inside legitimate processes. It features 14 commands for file enumeration, exfiltration, process management, screenshots, and PowerShell execution.

The attackers maintain an FTP Stats Panel to monitor campaign success, though at the time of analysis it showed only 11 execution events, suggesting the campaign is in its infancy. SOCRadar warns that while initial access methods point to shortcut-file phishing, attackers could easily adapt FTP banner abuse for ClickFix campaigns.