New E4del and PINHOLE RATs Abuse FTP Server Banners as Dead-Drop Resolvers
New E4del and PINHOLE RATs Abuse FTP Server Banners as (TL-2026-2117) is a high-severity malware campaign, first published 2026-08-22. It has no confirmed attribution, affects Microsoft Windows (desktop endpoints), maps to 14 MITRE ATT&CK techniques (T1027, T1036.005, T1055.004), and is covered by 9 detection rules and 9 indicators of compromise.
Key facts for TL-2026-2117
- Threat ID
- TL-2026-2117
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-22
- Last reviewed
- 2026-08-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in New E4del and PINHOLE RATs Abuse FTP Server Banners as
Malware and tooling: E4del, PINHOLE, FOFA
SOCRadar's Threat Research Unit identified two previously undocumented Windows RATs, E4del and PINHOLE, delivered via phishing ZIP/LNK chains since early July 2026. The campaign's novel technique hides C2 commands inside FTP server banner greeting messages, while PINHOLE additionally pulls its C2 configuration from Pinterest pins and SurveyMonkey surveys, proxied through Cloudflare Workers, for takedown resilience.
How New E4del and PINHOLE RATs Abuse FTP Server Banners as works
In early July 2026, MalwareHunterTeam observed an unusual infection chain: phishing-delivered ZIP archives containing malicious Windows shortcut (LNK) files that, once opened, connect to an attacker-controlled FTP server and extract PowerShell instructions encoded inside the server's banner greeting message -- the text normally shown to a client before authentication. SOCRadar's Threat Research Unit (STRU) expanded on this discovery and, using FOFA internet-asset searches, determined the FTP-banner dead-drop-resolver (DDR) technique has been weaponized since early July 2026 and remains operational, with new infrastructure observed as recently as August 2026. Researchers describe it as an alternative form of dead-drop-resolver infrastructure -- functionally similar to attackers hiding commands in a legitimate web service, but using an FTP banner instead -- while noting it is less stealthy than web-based DDRs because outbound connections to unfamiliar FTP servers are more conspicuous on a monitored network.
The chain delivers two distinct, previously undocumented RATs. E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as the Discord client. It supports persistent or temporary interactive shells, screenshot capture, desktop streaming over WebSockets, and download/execution of further payloads; its beaconing implements a tiered jitter scheme that shifts between Active, Semi-Active, and Inactive states depending on elapsed time since the last received task. E4del bundles a native Node.js module, crypto32.node, that researchers assess is intended to attempt privilege escalation, though the component itself could not be recovered and fully analyzed.
PINHOLE is the more sophisticated of the pair. It resolves its C2 configuration from legitimate third-party platforms -- Pinterest pins and SurveyMonkey survey questions -- and proxies its C2 traffic through Cloudflare Workers, a design intended to give the operators versatility and resilience against takedowns. On the host, PINHOLE minimizes its forensic footprint via shellcode fluctuation, keeping only a single ~4KB memory section of its payload resident at any given time, and evades EDR hooking with Halo's Gate (an indirect-syscall technique) before injecting its final shellcode into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE exposes 14 distinct C2 commands spanning file enumeration/upload/download, arbitrary command execution, process management, screenshot capture, and a module that harvests stored credentials from Chrome, Brave, and Edge. At the time of SOCRadar's analysis, the PINHOLE control script had logged only 11 execution events, suggesting the campaign is still in an early operational stage rather than mass distribution. No CVE, CISA KEV entry, or CVSS score has been published for this activity; attribution to a specific actor or group remains unestablished in public reporting.
MITRE ATT&CK techniques used in TL-2026-2117
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.004 Process Injection: Asynchronous Procedure Call; T1620 Reflective Code Loading
Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver
Collection
T1113 Screen Capture; T1125 Video Capture
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
Affected products and versions in New E4del and PINHOLE RATs Abuse FTP Server Banners as
- Microsoft — Windows (desktop endpoints)
Vulnerable versions: No version-specific vulnerability -- E4del/PINHOLE are delivered via phishing and social engineering against any Windows endpoint, not a software flaw
Remediation for New E4del and PINHOLE RATs Abuse FTP Server Banners as
Immediate actions
- Alert on and restrict outbound FTP (TCP/21) connections from endpoints to unfamiliar or newly-registered external hosts; treat any unsolicited FTP banner-grab followed by PowerShell execution as high-fidelity malicious activity.
- Block execution of LNK files delivered from ZIP archives in email/web-download attachments via mail-gateway and EDR attachment policies.
- Hunt for ApplicationFrameHost.exe processes with anomalous memory regions, suspended-then-resumed thread state, or QueueUserAPC activity indicative of Early Bird APC injection.
- Hunt for outbound HTTPS traffic to Pinterest and SurveyMonkey from endpoint processes that are not browsers, and for C2 traffic proxied through Cloudflare Workers domains (*.workers.dev).
Workarounds
- Disable or tightly restrict Windows Script Host / LNK auto-execution behavior for files originating from ZIP archives extracted from untrusted sources.
- Where FTP connectivity from endpoints is not a business requirement, block outbound TCP/21 entirely at the perimeter/EDR firewall.
Longer-term hardening
- Deploy EDR/XDR with kernel-level syscall telemetry capable of detecting Halo's Gate-style indirect syscall evasion, not just usermode API hooking.
- Enforce application allow-listing for Electron/Node.js binaries and flag signed Electron apps whose UI/branding does not match their code-signing identity.
- Harden browser credential storage (enable OS-level credential encryption / Application-Bound Encryption on Chrome, Brave, and Edge) to reduce the value of stolen browser credential stores.
- Feed FTP-banner content inspection into network detection tooling so encoded/anomalous banner strings from FTP servers trigger alerts.
Timeline of New E4del and PINHOLE RATs Abuse FTP Server Banners as
- MalwareHunterTeam first observes phishing-delivered ZIP archives with malicious LNK files abusing FTP server banners as dead-drop resolvers to retrieve PowerShell commands; SOCRadar's FOFA-based tracking places weaponization of the technique at 'early July 2026' (exact day undisclosed).
- The FTP-banner dead-drop-resolver campaign delivering E4del and PINHOLE continues operating through mid-to-late July 2026, per SOCRadar's telemetry window.
- SOCRadar STRU observes new FTP dead-drop-resolver infrastructure supporting the campaign as recently as August 2026, indicating the operation remains active rather than a one-off test.
- BleepingComputer, SC Media, The420.in, and Matrice Digitale publish independent coverage of the SOCRadar findings the same day, widening public awareness of the campaign.
- SOCRadar publishes 'FTP Banners: The New Dead Drop Resolver for RATs,' the first public technical analysis documenting E4del, PINHOLE, the FTP-banner DDR technique, and PINHOLE's Pinterest/SurveyMonkey/Cloudflare Workers C2 chain.
- At the time of SOCRadar's analysis, the PINHOLE C2 control script had logged only 11 execution events, indicating the malware is still in an early-stage, limited deployment rather than mass distribution.
Sources cited for New E4del and PINHOLE RATs Abuse FTP Server Banners as
- FTP Banners: The New Dead Drop Resolver for RATs
- Hackers abuse FTP server banners to deliver new Windows malware
- Attackers use FTP banners to hide new E4del and PINHOLE RATs
- New Malware Campaign Combines Phishing, PowerShell and FTP Infrastructure
- Threat actors found a new place to hide C2 commands: FTP banners
- FTP nasconde E4del e PINHOLE mentre Rust bonifica la supply chain
Threats related to New E4del and PINHOLE RATs Abuse FTP Server Banners as
Detection coverage for TL-2026-2117
As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2117 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.