FTP Server Banners Abused as Dead-Drop Resolvers to Deliver E4del and PINHOLE Windows RATs

Key facts for E4del PINHOLE FTP C2

Detection coverage for E4del PINHOLE FTP C2

As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2119 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Phishing ZIP/LNK Chain Spawning PowerShell FTP-Banner Stager

Detects the initial-access chain reported for the E4del/PINHOLE campaign: a user opens an LNK shortcut from a phishing ZIP, explorer.exe spawns a script interpreter (powershell.exe/wscript.exe/cmd.exe) referencing 'ftp', and the same host makes an outbound TCP connection to port 21 on an external, non-allow-listed IP within a short window. The FTP server's pre-authentication banner delivers an embedded PowerShell command that stages the intrusion before any FTP login occurs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1059.001, T1102.001
• Data sources: sysmon, windows_security, edr_process_events, network_connection_logs
• Severity: high
• Confidence: medium

Splunk SPL

(index=sysmon EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\cmd.exe") (CommandLine="*ftp*" OR CommandLine="*Net.Sockets.TcpClient*" OR CommandLine="*-enc*"))
| eval proc_time=_time
| join type=inner Computer, User [ search index=sysmon EventCode=3 DestinationPort=21
    | where NOT cidrmatch("10.0.0.0/8", DestinationIp) AND NOT cidrmatch("172.16.0.0/12", DestinationIp) AND NOT cidrmatch("192.168.0.0/16", DestinationIp)
    | lookup ftp_allowlist.csv DestinationIp OUTPUT is_allowed
    | where isnull(is_allowed)
    | eval net_time=_time
    | fields Computer, User, DestinationIp, DestinationPort, net_time ]
| where abs(proc_time - net_time) <= 300
| table _time, Computer, User, Image, ParentImage, CommandLine, DestinationIp, DestinationPort
| sort -_time

Microsoft KQL

let ftpAllowlist = datatable(dest:string)['ftp.internal.corp.example'];
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","wscript.exe","cscript.exe","cmd.exe")
| where ProcessCommandLine has_any ("ftp","TcpClient","-enc")
| project DeviceId, DeviceName, AccountName, ProcTime=Timestamp, FileName, ProcessCommandLine
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort == 21
    | where RemoteIPType == "Public"
    | where RemoteUrl !in (ftpAllowlist)
    | project DeviceId, NetTime=Timestamp, RemoteIP, RemotePort
) on DeviceId
| where abs(datetime_diff('second', ProcTime, NetTime)) <= 300
| project ProcTime, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort

Sigma

title: Phishing LNK Chain Spawning Script Interpreter Preceding Outbound FTP Connection
id: 7a1c3e2a-4f0b-4d5e-9a11-2c6e8b9d0a01
status: experimental
description: Detects explorer.exe spawning a script interpreter referencing FTP/socket activity, consistent with LNK-triggered execution of a PowerShell FTP-banner dead-drop-resolver stager (E4del/PINHOLE campaign, SOCRadar Aug 2026).
references:
    - https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-23
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.command-and-control
    - attack.t1102.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - 'ftp'
            - 'TcpClient'
            - '-enc'
    condition: selection_parent and selection_child and selection_cli
falsepositives:
    - Legitimate helpdesk or deployment scripts that invoke PowerShell alongside scripted FTP transfers
    - Developer tooling using System.Net.Sockets.TcpClient for internal diagnostics
level: high

Known false positives:

• Legitimate IT/helpdesk scripts that invoke PowerShell alongside scheduled FTP transfers to known, allow-listed FTP servers
• Developer workflows using scripted FTP clients or raw TCP sockets for internal file transfer

Tuning notes: Maintain the FTP allow-list lookup (ftp_allowlist.csv / KQL datatable) with known-good business FTP hosts to suppress routine traffic; narrow the correlation window if false positives persist from batch automation.

• 🔒 Explorer-Spawned Script Interpreter Correlated with Outbound Port 21 to Unfamiliar Host · unlock with TL Creds
• 🔒 Early Bird APC Injection into Suspended ApplicationFrameHost.exe · unlock with TL Creds
• 🔒 Electron Process WebSocket C2 with Screenshot/Video Capture API Usage · unlock with TL Creds
• 🔒 LNK-Triggered Script Interpreter Execution from User-Writable Path · unlock with TL Creds
• 🔒 Node.js Runtime Execution Outside Developer Context with Native Addon Load · unlock with TL Creds
• 🔒 Process Discovery and Local Data Staging Preceding Beaconing to Web-Service C2 · unlock with TL Creds
• 🔒 Discord-Masquerading Electron App with Mismatched Install Path/Publisher and [indicator] Load · unlock with TL Creds
• 🔒 Non-Browser Process Beaconing to Pinterest/SurveyMonkey Correlated with Browser Credential Store Access · unlock with TL Creds

Indicators of compromise for E4del PINHOLE FTP C2

As of 2026-08-23, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2119.

How E4del PINHOLE FTP C2 works

MalwareHunterTeam first observed a novel command-and-control technique in early July 2026: threat actors embedding malicious instructions inside the pre-authentication greeting banner of an FTP server. Because a client receives the banner text before it ever logs in, a compromised host can pull attacker commands from an FTP connection without needing valid credentials or a conventional web-based dead-drop resolver. SOCRadar's Threat Research Unit (STRU) expanded on the discovery, tracing the technique's infrastructure to two previously undocumented Windows remote access trojans it named E4del and PINHOLE, and confirmed the technique has remained actively weaponized since early July 2026, with new supporting infrastructure observed as recently as August 2026.

The observed infection chain begins with phishing that delivers a ZIP archive containing a malicious Windows shortcut (LNK) file. Executing the LNK triggers a connection to an attacker-controlled FTP server; the client reads the banner text returned before authentication and extracts an embedded PowerShell command, which is executed to stage the intrusion and fetch follow-on payloads.

E4del is a Node.js-based RAT distributed as a digitally signed Electron application that masquerades as the Discord desktop client, letting it install and run with reduced user suspicion and past casual code-signing checks. It supports command execution through persistent or temporary shells, screenshot capture, real-time desktop streaming over WebSockets, and downloading/executing additional payloads. Analysts also observed E4del attempting privilege escalation via a native module named crypto32.node; the module itself was not recovered for analysis, so its exact mechanism is undocumented.

PINHOLE is the more evasive of the two RATs. Rather than beaconing to a traditional domain or IP, it retrieves its C2 configuration from Pinterest pin content and SurveyMonkey survey questions — legitimate, difficult-to-block platforms that make the malware resilient to conventional domain/IP takedowns. For in-memory stealth, PINHOLE uses a technique researchers describe as "shellcode fluctuation," keeping only a single 4KB section of its payload resident in memory at any given time, and it injects into a suspended ApplicationFrameHost.exe process using Early Bird APC injection. PINHOLE supports 14 commands spanning file enumeration, file upload/download, arbitrary command execution, process management, screenshot capture, and deployment of a module that steals credentials stored in web browsers. At the time of the SOCRadar writeup, only 11 PINHOLE execution events had been observed, indicating an early-stage but ongoing and evolving campaign. Researchers assessed the FTP-banner channel itself as comparatively less stealthy than typical web-based dead-drop resolvers, since outbound FTP connections to unfamiliar servers are unusual and more conspicuous on a monitored network than routine HTTPS traffic — a detection opportunity for defenders. No CVE applies (this is a malware delivery/C2 technique, not a vulnerability), and no attacker attribution or concrete network/file IOCs (domains, IPs, hashes) have been publicly disclosed beyond the malware family names, tool names, and technique descriptions documented here.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Privilege Escalation

T1055.004 Asynchronous Procedure Call

Discovery

T1057 Process Discovery

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver

defense-impairment

T1553.002 Code Signing

Credential Access

T1555.003 Credentials from Web Browsers

Initial Access

T1566.001 Spearphishing Attachment

Remediation for E4del PINHOLE FTP C2

Immediate actions

• Block or tightly restrict outbound FTP connections from endpoints to unknown/uncategorized external servers; flag FTP client connections that are not part of a documented business workflow.
• Hunt for ZIP archives containing LNK files in email/download telemetry and block LNK execution from user-writable/temp/download directories via application control.
• Alert on Electron applications that present as Discord but do not match Discord's known installation path, publisher chain, or update mechanism.
• Monitor for anomalous child-process activity from ApplicationFrameHost.exe (Early Bird APC injection targets a suspended instance of this process) and for Node.js runtime execution outside of expected developer contexts.
• Inspect and alert on outbound HTTPS requests to pinterest.com and surveymonkey.com from endpoint/server assets that have no legitimate business reason to reach either service.

Workarounds

• Where FTP is not a required business protocol, disable outbound FTP entirely at the perimeter/EDR to close off the dead-drop-resolver channel.

Longer-term hardening

• Deploy EDR with memory-scanning/behavioral detection capable of catching low-footprint, in-memory-only payloads (PINHOLE keeps only ~4KB resident at a time to evade static memory scans).
• Implement network egress filtering/allow-listing so that dead-drop-resolver abuse of legitimate platforms (social media, survey tools, FTP banners) is visible as anomalous traffic rather than blending into normal browsing.
• Add code-signing certificate reputation/anomaly monitoring, since E4del relies on a valid digital signature to reduce scrutiny.
• Build detection content for Early Bird APC injection into suspended processes and for shell/WebSocket-based remote desktop streaming.

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: All supported Windows desktop versions (delivery/execution technique, not a version-specific vulnerability)

Timeline of E4del PINHOLE FTP C2

• 2026-07-01 MalwareHunterTeam first observes threat actors embedding C2 commands inside FTP server banner greeting messages, using them as a pre-authentication dead-drop resolver (reported as 'early July 2026'; exact day not disclosed).
• 2026-07-15 SOCRadar's Threat Research Unit (STRU) expands on the discovery, tracing the FTP-banner dead-drop-resolver infrastructure to two previously undocumented Windows RATs it names locked-ioc-10 and locked-ioc-8, and confirms the technique has remained continuously weaponized since early July 2026 (mid-point estimate; exact date not disclosed).
• 2026-08-01 SOCRadar records new C2-supporting infrastructure for the campaign as recently as August 2026, indicating the operation is still active and evolving (exact date not disclosed).
• 2026-08-21 SC Media publishes a brief on the campaign, noting researchers' assessment that the FTP-banner channel is 'less stealthy than traditional web-based dead-drop resolvers due to the unusual nature of FTP connections to unknown servers.'
• 2026-08-21 BleepingComputer publishes the first public writeup of the FTP-banner dead-drop-resolver technique and the locked-ioc-10/locked-ioc-8 RATs, based on SOCRadar's research.
• 2026-08-23 TL-Intel-Harness HUNT phase ingests the BleepingComputer article and opens threat TL-2026-2119 for RESEARCH.

Sources cited for E4del PINHOLE FTP C2

• Threat actors found a new place to hide C2 commands: FTP banners. SOCRadar's STRU traced this to two undocumented RATs — E4del and PINHOLE. malwaretips.com · Blog · 2026-08-21
• Rust Supply Chain Attack, Entra ID Zero-Day, and Cisco, TrueConf Patches blog.hunterstrategy.net · Blog · 2026-08-22
• Hackers abuse FTP server banners to deliver new Windows malware BleepingComputer · News · 2026-08-21
• Attackers use FTP banners to hide new E4del and PINHOLE RATs scworld.com · News · 2026-08-21
• New Malware Campaign Combines Phishing, PowerShell and FTP Infrastructure the420.in · News · 2026-08-21
• ハッカーがFTPサーバーのバナーを悪用し、新たなWindows向けマルウェアを拡散させている prsol.cc · News · 2026-08-22

Threats related to E4del PINHOLE FTP C2

• Commodity Infostealers Hijacking Claude Login Sessions to Drain Account Usage
• VOID#GEIST Multi-RAT Campaign — Early Bird APC Injection Delivering XWorm, AsyncRAT, and Xeno RAT via Python Runtime
• Aeternum Loader Uses Polygon Blockchain Smart Contracts for Resilient C2, Deploys XWorm and XMRig
• StealC Infostealer and Amadey Loader Malware-as-a-Service Cybercrime Ecosystem (Operation Endgame Disruption)

Previous and next in malware

• Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlight Previous report
• Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers, Backdoors and Malicious Browser Extensions Next report