Cybersecurity
Attackers use FTP banners to deliver two RATs
SOCRadar said attackers used FTP server banners as a command channel in a campaign that delivered E4del and PINHOLE, after MalwareHunterTeam had earlier seen the same method in July.
- MalwareHunterTeam observed an attack in July that used .LNK files and FTP server banners to retrieve commands.
- SOCRadar said its investigation found the same method still in use and that it had been used since early July 2026, with new infrastructure seen in August 2026.
- SOCRadar said the campaign began with a ZIP archive that triggered an LNK infection chain and probably started with phishing.
- The infection chain delivered two remote access trojans, E4del and PINHOLE, and both retrieved a PowerShell script from FTP banners.
MalwareHunterTeam first saw the technique in July, when an attack used shortcut files and FTP server banners to pull down commands. SOCRadar later said its own investigation found the same approach still active.
SOCRadar said the observed infections began with a ZIP archive that led into an LNK-based chain. The researchers said the initial compromise likely came through phishing, and that commands were carried in the first response from an FTP server.
The researchers said E4del was a Node.js RAT wrapped inside a signed Electron application that posed as Discord. They said it could run commands, take screenshots, stream the desktop over WebSockets, and download further payloads, and that they had also seen a Node.js module called crypto32.node that they could not recover.
SOCRadar said PINHOLE pulled its command-and-control settings from Pinterest pins and SurveyMonkey survey questions. It said the malware used shellcode fluctuation, kept only part of the payload in memory at a time, and injected the final assembly into a suspended ApplicationFrameHost.exe process through Early Bird APC injection.
SOCRadar said PINHOLE supported 14 commands and that its script had logged only 11 execution events at the time of analysis, which suggested an early-stage campaign. The researchers also said the banner-based method was less stealthy than web services such as X, GitHub and YouTube, but could be adapted for ClickFix campaigns and was accompanied by indicators of compromise.
Named in this story
Companies
- SOCRadar
- expanded the hunt and published the report
- one source of PINHOLE configuration data
- SurveyMonkey
- one source of PINHOLE configuration data
Organisations
- MalwareHunterTeam
- first observed the banner-based technique in July
Products and systems
- E4del
- one of the two remote access trojans delivered in the campaign
- PINHOLE
- one of the two remote access trojans delivered in the campaign
- crypto32.node
- a Node.js module that reportedly attempted privilege escalation
- Discord
- the application E4del masqueraded as
- ApplicationFrameHost.exe
- the process PINHOLE injected into
- FOFA
- used by SOCRadar in its searches
- X
- cited as an example of a web service used for dead-drop delivery
- GitHub
- cited as an example of a web service used for dead-drop delivery
- YouTube
- cited as an example of a web service used for dead-drop delivery
How the source tells it
The article read like a threat-intelligence report, with light novelty framing and emphasis on the campaign being active and adaptable.
- novelty framing the delivery method was presented as a new alternative and a versatile one
- threat emphasis the campaign was described as weaponised and still operational