MEDIUM Malware #RAT #Phishing

FTP Banners Abused to Deliver E4del and PINHOLE RATs

2026-08-24 08:38 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Threat actors are delivering new E4del and PINHOLE remote access trojans by embedding commands in FTP server banners.
Affected systems include Windows hosts targeted by LNK-based infection chains, likely originating from phishing campaigns.
Implement robust endpoint detection and network monitoring to identify unusual FTP connections and LNK file execution.

Overview

Threat actors have been observed employing a novel technique involving the abuse of FTP server banners to deliver malicious commands, ultimately leading to the deployment of two previously undocumented remote access trojans (RATs) named E4del and PINHOLE. This method leverages FTP banners, which are typically greeting messages from a server, as dead-drop resolvers (DDRs) to retrieve PowerShell scripts that initiate the infection chain. This unusual tactic was initially identified by MalwareHunterTeam in July 2026 and further investigated by SOCRadar, confirming its continued use as recently as August 2026, according to a report shared with BleepingComputer.

Technical Analysis

The attack typically commences with a ZIP archive, likely delivered via phishing, which contains a shortcut file (.LNK) designed to trigger the initial compromise. This LNK-based infection chain is crucial for the early stages of the attack, as it executes the initial PowerShell script from an FTP banner.

Instead of traditional web services like X (formerly Twitter), GitHub, or YouTube, threat actors are leveraging FTP banners. When a compromised system connects to a designated FTP server, the server’s initial greeting message contains embedded commands. These commands direct the malware stager on the infected host to fetch and execute further payloads. While this technique offers a novel alternative, SOCRadar notes that it is less stealthy than using legitimate web-based DDRs, as FTP connections to unknown or unusual servers are more likely to attract attention from security monitoring tools.

E4del Remote Access Trojan

E4del is a Node.js-based RAT encapsulated within a digitally signed Electron application. It masquerades as Discord to evade detection and gain user trust. Its capabilities are extensive, including the ability to run commands via persistent or temporary shells, capture screenshots, stream the desktop over WebSockets, and download and execute additional payloads. Researchers also identified a Node.js module, crypto32.node, attempting privilege escalation, though it could not be retrieved for full analysis.

PINHOLE Remote Access Trojan

PINHOLE is another sophisticated RAT characterized by its minimal host footprint and resilient command-and-control (C2) infrastructure. It retrieves its C2 configuration from legitimate services like Pinterest pins and SurveyMonkey survey questions, offering significant versatility and resistance to takedowns. The malware maintains a stealthy presence by using shellcode fluctuation, keeping only a 4KB section of its payload in memory at any given time, and injecting its final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 distinct commands, enabling file enumeration, uploading and downloading files, command execution, process management, screenshot capture, and deploying a module for stealing credentials stored in web browsers. At the time of analysis, the PINHOLE script had only 11 execution events, indicating the campaign was in its early stages.

Recommendations and Mitigations

Organizations should prioritize detection and prevention strategies to counter this evolving threat.

Detecting E4del and PINHOLE RATs

Enhanced Network Monitoring: Implement strict monitoring for unusual outbound FTP connections, particularly to uncommon or non-corporate FTP servers. Unusual data within FTP banner responses should trigger alerts.
Endpoint Detection and Response (EDR): Deploy and configure EDR solutions to detect LNK-based infection chain activities, anomalous PowerShell script execution, and suspicious process injection attempts, especially into ApplicationFrameHost.exe.
Application Whitelisting: Restrict the execution of unsigned or unauthorized Node.js-based applications, particularly those masquerading as legitimate software like Discord.
Traffic Analysis: Monitor for C2 traffic patterns associated with Pinterest or SurveyMonkey that deviate from normal user activity, especially from non-browser processes.

General Security Practices

Phishing Awareness Training: Continuously educate employees on identifying and reporting phishing attempts, as initial access likely relies on social engineering to deliver ZIP archives containing malicious LNK files.
Indicator of Compromise (IoC) Management: Regularly update security systems with the latest IoCs provided by threat intelligence platforms like SOCRadar to identify malicious infrastructure.
Regular Patching: Ensure all operating systems and applications are consistently updated to reduce the attack surface for privilege escalation attempts or other vulnerabilities.

#RAT #Phishing

X/Twitter LinkedIn Reddit HN

← Back to Articles