FTP Server Banners Abused as Dead-Drop Resolvers to Deliver E4del and PINHOLE Windows RATs
FTP Server Banners Abused as Dead-Drop Resolvers to Deliver (TL-2026-2119) is a high-severity malware campaign, first published 2026-08-23. It has no confirmed attribution, affects Microsoft Windows, maps to 13 MITRE ATT&CK techniques (T1005, T1036.005, T1055.004), and is covered by 9 detection rules and 10 indicators of compromise.
Key facts for TL-2026-2119
- Threat ID
- TL-2026-2119
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-23
- Last reviewed
- 2026-08-23
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in FTP Server Banners Abused as Dead-Drop Resolvers to Deliver
Malware and tooling: E4del, PINHOLE, Electron, FTP dead-drop banner server, Node.js
Threat actors are embedding C2 commands inside FTP server banner greeting messages, using them as dead-drop resolvers to deliver two previously undocumented Windows RATs, E4del and PINHOLE. E4del is a Node.js-based RAT packaged in a digitally signed Electron app masquerading as Discord; PINHOLE pulls its configuration from Pinterest pins and SurveyMonkey surveys and supports 14 commands including credential theft.
How FTP Server Banners Abused as Dead-Drop Resolvers to Deliver works
MalwareHunterTeam first observed a novel command-and-control technique in early July 2026: threat actors embedding malicious instructions inside the pre-authentication greeting banner of an FTP server. Because a client receives the banner text before it ever logs in, a compromised host can pull attacker commands from an FTP connection without needing valid credentials or a conventional web-based dead-drop resolver. SOCRadar's Threat Research Unit (STRU) expanded on the discovery, tracing the technique's infrastructure to two previously undocumented Windows remote access trojans it named E4del and PINHOLE, and confirmed the technique has remained actively weaponized since early July 2026, with new supporting infrastructure observed as recently as August 2026.
The observed infection chain begins with phishing that delivers a ZIP archive containing a malicious Windows shortcut (LNK) file. Executing the LNK triggers a connection to an attacker-controlled FTP server; the client reads the banner text returned before authentication and extracts an embedded PowerShell command, which is executed to stage the intrusion and fetch follow-on payloads.
E4del is a Node.js-based RAT distributed as a digitally signed Electron application that masquerades as the Discord desktop client, letting it install and run with reduced user suspicion and past casual code-signing checks. It supports command execution through persistent or temporary shells, screenshot capture, real-time desktop streaming over WebSockets, and downloading/executing additional payloads. Analysts also observed E4del attempting privilege escalation via a native module named crypto32.node; the module itself was not recovered for analysis, so its exact mechanism is undocumented.
PINHOLE is the more evasive of the two RATs. Rather than beaconing to a traditional domain or IP, it retrieves its C2 configuration from Pinterest pin content and SurveyMonkey survey questions — legitimate, difficult-to-block platforms that make the malware resilient to conventional domain/IP takedowns. For in-memory stealth, PINHOLE uses a technique researchers describe as "shellcode fluctuation," keeping only a single 4KB section of its payload resident in memory at any given time, and it injects into a suspended ApplicationFrameHost.exe process using Early Bird APC injection. PINHOLE supports 14 commands spanning file enumeration, file upload/download, arbitrary command execution, process management, screenshot capture, and deployment of a module that steals credentials stored in web browsers. At the time of the SOCRadar writeup, only 11 PINHOLE execution events had been observed, indicating an early-stage but ongoing and evolving campaign. Researchers assessed the FTP-banner channel itself as comparatively less stealthy than typical web-based dead-drop resolvers, since outbound FTP connections to unfamiliar servers are unusual and more conspicuous on a monitored network than routine HTTPS traffic — a detection opportunity for defenders. No CVE applies (this is a malware delivery/C2 technique, not a vulnerability), and no attacker attribution or concrete network/file IOCs (domains, IPs, hashes) have been publicly disclosed beyond the malware family names, tool names, and technique descriptions documented here.
MITRE ATT&CK techniques used in TL-2026-2119
Collection
T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Privilege Escalation
T1055.004 Asynchronous Procedure Call
Discovery
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver
defense-impairment
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in FTP Server Banners Abused as Dead-Drop Resolvers to Deliver
- Microsoft — Windows
Vulnerable versions: All supported Windows desktop versions (delivery/execution technique, not a version-specific vulnerability)
Remediation for FTP Server Banners Abused as Dead-Drop Resolvers to Deliver
Immediate actions
- Block or tightly restrict outbound FTP connections from endpoints to unknown/uncategorized external servers; flag FTP client connections that are not part of a documented business workflow.
- Hunt for ZIP archives containing LNK files in email/download telemetry and block LNK execution from user-writable/temp/download directories via application control.
- Alert on Electron applications that present as Discord but do not match Discord's known installation path, publisher chain, or update mechanism.
- Monitor for anomalous child-process activity from ApplicationFrameHost.exe (Early Bird APC injection targets a suspended instance of this process) and for Node.js runtime execution outside of expected developer contexts.
- Inspect and alert on outbound HTTPS requests to pinterest.com and surveymonkey.com from endpoint/server assets that have no legitimate business reason to reach either service.
Workarounds
- Where FTP is not a required business protocol, disable outbound FTP entirely at the perimeter/EDR to close off the dead-drop-resolver channel.
Longer-term hardening
- Deploy EDR with memory-scanning/behavioral detection capable of catching low-footprint, in-memory-only payloads (PINHOLE keeps only ~4KB resident at a time to evade static memory scans).
- Implement network egress filtering/allow-listing so that dead-drop-resolver abuse of legitimate platforms (social media, survey tools, FTP banners) is visible as anomalous traffic rather than blending into normal browsing.
- Add code-signing certificate reputation/anomaly monitoring, since E4del relies on a valid digital signature to reduce scrutiny.
- Build detection content for Early Bird APC injection into suspended processes and for shell/WebSocket-based remote desktop streaming.
Timeline of FTP Server Banners Abused as Dead-Drop Resolvers to Deliver
- MalwareHunterTeam first observes threat actors embedding C2 commands inside FTP server banner greeting messages, using them as a pre-authentication dead-drop resolver (reported as 'early July 2026'; exact day not disclosed).
- SOCRadar's Threat Research Unit (STRU) expands on the discovery, tracing the FTP-banner dead-drop-resolver infrastructure to two previously undocumented Windows RATs it names E4del and PINHOLE, and confirms the technique has remained continuously weaponized since early July 2026 (mid-point estimate; exact date not disclosed).
- SOCRadar records new C2-supporting infrastructure for the campaign as recently as August 2026, indicating the operation is still active and evolving (exact date not disclosed).
- SC Media publishes a brief on the campaign, noting researchers' assessment that the FTP-banner channel is 'less stealthy than traditional web-based dead-drop resolvers due to the unusual nature of FTP connections to unknown servers.'
- BleepingComputer publishes the first public writeup of the FTP-banner dead-drop-resolver technique and the E4del/PINHOLE RATs, based on SOCRadar's research.
- TL-Intel-Harness HUNT phase ingests the BleepingComputer article and opens threat TL-2026-2119 for RESEARCH.
Sources cited for FTP Server Banners Abused as Dead-Drop Resolvers to Deliver
- Hackers abuse FTP server banners to deliver new Windows malware
- Attackers use FTP banners to hide new E4del and PINHOLE RATs
- New Malware Campaign Combines Phishing, PowerShell and FTP Infrastructure
- Threat actors found a new place to hide C2 commands: FTP banners. SOCRadar's STRU traced this to two undocumented RATs — E4del and PINHOLE.
- Rust Supply Chain Attack, Entra ID Zero-Day, and Cisco, TrueConf Patches
- ハッカーがFTPサーバーのバナーを悪用し、新たなWindows向けマルウェアを拡散させている
Threats related to FTP Server Banners Abused as Dead-Drop Resolvers to Deliver
Detection coverage for TL-2026-2119
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2119 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.