# FTP Server Banners Abused as Dead-Drop Resolvers to Deliver E4del and PINHOLE Windows RATs

> Threat actors are embedding C2 commands inside FTP server banner greeting messages, using them as dead-drop resolvers to deliver two previously undocumented Windows RATs, E4del and PINHOLE. E4del is a Node.js-based RAT packaged in a digitally signed Electron app masquerading as Discord; PINHOLE pulls its configuration from Pinterest pins and SurveyMonkey surveys and supports 14 commands including credential theft.

- **Published:** 2026-08-23T00:00:00Z
- **Last reviewed:** 2026-08-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2119
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-e4del-pinhole-ftp-c2-tl-2026-2119.webp?v=63b0c4a4 (Threadlinqs threat intel: E4del and PINHOLE Windows RATs: FTP Dead-Drop C2 (TL-2026-2119) — High severity, 10 IOCs, 9 detection rules.)
- **ID:** TL-2026-2119
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

MalwareHunterTeam first observed a novel command-and-control technique in early July 2026: threat actors embedding malicious instructions inside the pre-authentication greeting banner of an FTP server. Because a client receives the banner text before it ever logs in, a compromised host can pull attacker commands from an FTP connection without needing valid credentials or a conventional web-based dead-drop resolver. SOCRadar's Threat Research Unit (STRU) expanded on the discovery, tracing the technique's infrastructure to two previously undocumented Windows remote access trojans it named E4del and PINHOLE, and confirmed the technique has remained actively weaponized since early July 2026, with new supporting infrastructure observed as recently as August 2026.

The observed infection chain begins with phishing that delivers a ZIP archive containing a malicious Windows shortcut (LNK) file. Executing the LNK triggers a connection to an attacker-controlled FTP server; the client reads the banner text returned before authentication and extracts an embedded PowerShell command, which is executed to stage the intrusion and fetch follow-on payloads.

E4del is a Node.js-based RAT distributed as a digitally signed Electron application that masquerades as the Discord desktop client, letting it install and run with reduced user suspicion and past casual code-signing checks. It supports command execution through persistent or temporary shells, screenshot capture, real-time desktop streaming over WebSockets, and downloading/executing additional payloads. Analysts also observed E4del attempting privilege escalation via a native module named crypto32.node; the module itself was not recovered for analysis, so its exact mechanism is undocumented.

PINHOLE is the more evasive of the two RATs. Rather than beaconing to a traditional domain or IP, it retrieves its C2 configuration from Pinterest pin content and SurveyMonkey survey questions — legitimate, difficult-to-block platforms that make the malware resilient to conventional domain/IP takedowns. For in-memory stealth, PINHOLE uses a technique researchers describe as "shellcode fluctuation," keeping only a single 4KB section of its payload resident in memory at any given time, and it injects into a suspended ApplicationFrameHost.exe process using Early Bird APC injection. PINHOLE supports 14 commands spanning file enumeration, file upload/download, arbitrary command execution, process management, screenshot capture, and deployment of a module that steals credentials stored in web browsers. At the time of the SOCRadar writeup, only 11 PINHOLE execution events had been observed, indicating an early-stage but ongoing and evolving campaign. Researchers assessed the FTP-banner channel itself as comparatively less stealthy than typical web-based dead-drop resolvers, since outbound FTP connections to unfamiliar servers are unusual and more conspicuous on a monitored network than routine HTTPS traffic — a detection opportunity for defenders. No CVE applies (this is a malware delivery/C2 technique, not a vulnerability), and no attacker attribution or concrete network/file IOCs (domains, IPs, hashes) have been publicly disclosed beyond the malware family names, tool names, and technique descriptions documented here.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1553.002 Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1055.004 Asynchronous Procedure Call
- T1555.003 Credentials from Web Browsers
- T1057 Process Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Phishing ZIP/LNK Chain Spawning PowerShell FTP-Banner Stager** (`TL-2026-2119-SPL-001`)

Detects the initial-access chain reported for the E4del/PINHOLE campaign: a user opens an LNK shortcut from a phishing ZIP, explorer.exe spawns a script interpreter (powershell.exe/wscript.exe/cmd.exe) referencing 'ftp', and the same host makes an outbound TCP connection to port 21 on an external, non-allow-listed IP within a short window. The FTP server's pre-authentication banner delivers an embedded PowerShell command that stages the intrusion before any FTP login occurs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059.001, T1102.001
- **Data sources:** sysmon, windows_security, edr_process_events, network_connection_logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
(index=sysmon EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\cmd.exe") (CommandLine="*ftp*" OR CommandLine="*Net.Sockets.TcpClient*" OR CommandLine="*-enc*"))
| eval proc_time=_time
| join type=inner Computer, User [ search index=sysmon EventCode=3 DestinationPort=21
    | where NOT cidrmatch("10.0.0.0/8", DestinationIp) AND NOT cidrmatch("172.16.0.0/12", DestinationIp) AND NOT cidrmatch("192.168.0.0/16", DestinationIp)
    | lookup ftp_allowlist.csv DestinationIp OUTPUT is_allowed
    | where isnull(is_allowed)
    | eval net_time=_time
    | fields Computer, User, DestinationIp, DestinationPort, net_time ]
| where abs(proc_time - net_time) <= 300
| table _time, Computer, User, Image, ParentImage, CommandLine, DestinationIp, DestinationPort
| sort -_time
```

### Microsoft KQL

```kql
let ftpAllowlist = datatable(dest:string)['ftp.internal.corp.example'];
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","wscript.exe","cscript.exe","cmd.exe")
| where ProcessCommandLine has_any ("ftp","TcpClient","-enc")
| project DeviceId, DeviceName, AccountName, ProcTime=Timestamp, FileName, ProcessCommandLine
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort == 21
    | where RemoteIPType == "Public"
    | where RemoteUrl !in (ftpAllowlist)
    | project DeviceId, NetTime=Timestamp, RemoteIP, RemotePort
) on DeviceId
| where abs(datetime_diff('second', ProcTime, NetTime)) <= 300
| project ProcTime, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort
```

### Sigma

```yaml
title: Phishing LNK Chain Spawning Script Interpreter Preceding Outbound FTP Connection
id: 7a1c3e2a-4f0b-4d5e-9a11-2c6e8b9d0a01
status: experimental
description: Detects explorer.exe spawning a script interpreter referencing FTP/socket activity, consistent with LNK-triggered execution of a PowerShell FTP-banner dead-drop-resolver stager (E4del/PINHOLE campaign, SOCRadar Aug 2026).
references:
    - https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-23
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.command-and-control
    - attack.t1102.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - 'ftp'
            - 'TcpClient'
            - '-enc'
    condition: selection_parent and selection_child and selection_cli
falsepositives:
    - Legitimate helpdesk or deployment scripts that invoke PowerShell alongside scripted FTP transfers
    - Developer tooling using System.Net.Sockets.TcpClient for internal diagnostics
level: high
```

**Known false positives:**

- Legitimate IT/helpdesk scripts that invoke PowerShell alongside scheduled FTP transfers to known, allow-listed FTP servers
- Developer workflows using scripted FTP clients or raw TCP sockets for internal file transfer

**Tuning notes:** Maintain the FTP allow-list lookup (ftp_allowlist.csv / KQL datatable) with known-good business FTP hosts to suppress routine traffic; narrow the correlation window if false positives persist from batch automation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Explorer-Spawned Script Interpreter Correlated with Outbound Port 21 to Unfamiliar Host (locked: unlock with TL Creds)
- Early Bird APC Injection into Suspended ApplicationFrameHost.exe (locked: unlock with TL Creds)
- Electron Process WebSocket C2 with Screenshot/Video Capture API Usage (locked: unlock with TL Creds)
- LNK-Triggered Script Interpreter Execution from User-Writable Path (locked: unlock with TL Creds)
- Node.js Runtime Execution Outside Developer Context with Native Addon Load (locked: unlock with TL Creds)
- Process Discovery and Local Data Staging Preceding Beaconing to Web-Service C2 (locked: unlock with TL Creds)
- Discord-Masquerading Electron App with Mismatched Install Path/Publisher and [indicator] Load (locked: unlock with TL Creds)
- Non-Browser Process Beaconing to Pinterest/SurveyMonkey Correlated with Browser Credential Store Access (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Hackers abuse FTP server banners to deliver new Windows malware](https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/)
- [Attackers use FTP banners to hide new E4del and PINHOLE RATs](https://www.scworld.com/brief/attackers-use-ftp-banners-to-hide-new-e4del-and-pinhole-rats)
- [New Malware Campaign Combines Phishing, PowerShell and FTP Infrastructure](https://the420.in/ftp-banner-malware-e4del-pinhole-windows-rat-cyberattack-campaign/)
- [Threat actors found a new place to hide C2 commands: FTP banners. SOCRadar's STRU traced this to two undocumented RATs — E4del and PINHOLE.](https://malwaretips.com/threads/threat-actors-found-a-new-place-to-hide-c2-commands-ftp-banners-socradars-stru-traced-this-to-two-undocumented-rats-%E2%80%94-e4del-and-pinhole.142887/)
- [Rust Supply Chain Attack, Entra ID Zero-Day, and Cisco, TrueConf Patches](https://blog.hunterstrategy.net/rust-supply-chain-attack-entra-id-zero-day-and-cisco-trueconf-patches/)
- [ハッカーがFTPサーバーのバナーを悪用し、新たなWindows向けマルウェアを拡散させている](https://www.prsol.cc/2026/08/22/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2119