Hackers Abuse FTP Server Banners to Deliver New Windows Malware

Threat actors are employing an unconventional and sophisticated tactic, leveraging the seemingly innocuous greeting messages of File Transfer Protocol (FTP) servers to embed malicious commands. This technique, discovered by security researchers, has been used to deliver two previously undocumented remote access trojans (RATs), named E4del and PINHOLE, to unsuspecting Windows systems. The discovery highlights a growing trend of attackers creatively repurposing legitimate infrastructure for malicious purposes, posing a significant challenge to conventional cybersecurity defenses.

Discovery of an Emerging Threat Vector

The unusual method was first brought to light in July by MalwareHunterTeam, a collective of cybersecurity researchers who observed an attack chain utilizing shortcut files (.LNK) and FTP server banners as "dead-drop resolvers" (DDRs). DDRs are a crucial component in many malware operations, serving as a method for malware to discreetly retrieve instructions or further payloads from a command-and-control (C2) server without direct, obvious communication.

FTP banners are typically text strings displayed by an FTP server as a welcoming message to connecting hosts before the user completes the login process. Traditionally, these banners are used for informational purposes, such as identifying the server software or providing contact details. However, in this instance, threat actors have subverted this function by encoding commands within these banners. When a compromised system, acting as a malware stager, connects to a specially crafted FTP server, it receives these hidden instructions as part of the initial greeting.

Expanding the Investigation and Timeline

Following the initial discovery, researchers at the threat intelligence platform SOCRadar initiated a broader investigation. Their efforts revealed that this technique was not an isolated incident but rather a part of an ongoing operation that had been weaponized since early July 2026. SOCRadar’s analysis, aided by FOFA (Fofa.info) searches, which help identify internet-connected devices and services, indicated that the malicious infrastructure was actively being updated, with new components observed as recently as August 2026. This timeline suggests a persistent and evolving threat.

The typical infection chain, as detailed in a report shared with BleepingComputer, commences with a ZIP archive. Upon extraction, this archive triggers an infection process initiated by a malicious shortcut file (.LNK). The initial compromise vector is strongly suspected to be phishing campaigns, where users are tricked into opening the malicious archive and executing the LNK file, thereby initiating the malware deployment.

The Dual Threat: E4del and PINHOLE RATs

The LNK-based infection chain ultimately delivers two distinct remote access trojans: E4del and PINHOLE. Both RATs rely on the FTP banner technique to retrieve essential PowerShell scripts that drive their functionality.

E4del: The Discord Imposter

E4del is a sophisticated RAT built using Node.js and packaged within a digitally signed Electron application. This deceptive packaging allows it to masquerade as a legitimate application, specifically Discord, a popular communication platform. This social engineering aspect makes it harder for users and security software to flag it as suspicious.

The capabilities of the E4del RAT are extensive and concerning. It supports the execution of commands through both persistent and temporary shells, allowing attackers to maintain a long-term presence on the infected system or conduct quick, ephemeral operations. Beyond command execution, E4del can capture screenshots of the user’s desktop, stream the desktop activity in real-time over WebSockets, and is capable of downloading and executing further malicious payloads. This modularity allows attackers to adapt their approach and escalate their attack once initial access is gained.

SOCRadar also identified a Node.js module named crypto32.node associated with E4del. This module reportedly attempts privilege escalation on the compromised system, a critical step for attackers looking to gain deeper control. However, researchers were unable to retrieve this specific module for in-depth analysis, leaving its exact functionalities and success rates unconfirmed. The presence of a privilege escalation module indicates a deliberate effort to move beyond basic user-level access.

E4del Delivery Chain and Capabilities:

• Initial Compromise: Phishing campaign delivering a ZIP archive.
• Execution Trigger: Malicious LNK file within the archive.
• Command Retrieval: FTP server banners used as Dead-Drop Resolvers (DDRs).
• Payload Delivery: PowerShell script retrieved from FTP banners.
• RAT: E4del (Node.js-based, disguised as Discord Electron app).
• Key Capabilities:
  • Persistent and temporary shell access.
  • Screenshot capture.
  • Real-time desktop streaming (WebSockets).
  • Download and execution of additional payloads.
  • Attempted privilege escalation (via crypto32.node).

PINHOLE: Resilience and Stealth

The second RAT, PINHOLE, employs an even more innovative approach for its C2 configuration retrieval. Instead of relying solely on FTP banners for all its operational parameters, PINHOLE dynamically fetches its C2 configuration from seemingly innocuous sources: Pinterest pins and SurveyMonkey survey questions. This tactic provides a high degree of versatility and resilience against takedown efforts. By embedding C2 data within legitimate, high-traffic platforms, the malware can blend in and adapt its communication channels more effectively.

PINHOLE is designed for stealth, leaving a minimal footprint on the host system. It utilizes shellcode fluctuation, a technique where only a small portion of the payload (a 4KB section) resides in memory at any given time. This makes it harder for memory analysis tools to detect the complete malicious code. Furthermore, PINHOLE injects its final assembly into a suspended ApplicationFrameHost.exe process using an Early Bird Asynchronous Procedure Call (APC) injection. This technique allows the malware to execute within a legitimate process, further evading detection.

The RAT supports a robust set of 14 distinct commands, encompassing a wide range of malicious activities. These include file enumeration (listing files and directories), uploading and downloading files to and from the compromised system, arbitrary command execution, process management (starting, stopping, and querying processes), screenshot capture, and the deployment of a module specifically designed to steal credentials stored in web browsers. The credential theft module is particularly concerning, as it targets sensitive user data.

At the time of SOCRadar’s analysis, the PINHOLE script showed only 11 execution events, suggesting that the campaign utilizing this RAT was in its nascent stages. This indicates a potential for significant expansion and impact as the attackers refine their operations.

PINHOLE Execution Chain and Capabilities:

• Initial Compromise: Phishing campaign delivering a ZIP archive.
• Execution Trigger: Malicious LNK file within the archive.
• Command Retrieval: FTP server banners used as Dead-Drop Resolvers (DDRs) for initial scripts.
• C2 Configuration Retrieval: Pinterest pins and SurveyMonkey survey questions.
• RAT: PINHOLE (highly stealthy, minimal memory footprint).
• Execution Technique: Shellcode fluctuation, APC injection into ApplicationFrameHost.exe.
• Key Capabilities:
  • File enumeration.
  • File upload and download.
  • Command execution.
  • Process management.
  • Screenshot capture.
  • Browser credential theft module.

Analysis of the FTP Banner Technique

While the use of FTP banners as a Dead-Drop Resolver is a novel approach, SOCRadar notes that it is generally less stealthy than traditional web-based DDRs. Legitimate web services like X (formerly Twitter), GitHub, or YouTube are often used by attackers because their high volume of expected network traffic can help camouflage malicious activity. In contrast, FTP connections to unknown or unusual servers are more likely to stand out to network monitoring systems.

However, the adaptability of this technique is undeniable. SOCRadar suggests that it could "easily" be adapted for other social engineering campaigns, such as those employing ClickFix malware, which often relies on deceptive links or hidden execution methods. The core principle of embedding command-and-control information within unexpected communication protocols or data streams remains a potent threat.

Broader Implications and Defense Strategies

The emergence of E4del and PINHOLE, delivered via FTP banner manipulation, underscores the dynamic and evolving nature of cyber threats. Attackers are continuously exploring new avenues to bypass security measures and achieve their objectives. This trend necessitates a proactive and multi-layered security posture for organizations.

Key implications include:

• Evolving Threat Landscape: The need for continuous threat intelligence and adaptation of security defenses to counter novel attack vectors.
• Importance of Network Monitoring: Enhanced network traffic analysis is crucial to detect anomalous FTP connections or unusual banner content.
• Phishing Awareness: Strengthening user education and implementing robust anti-phishing measures remain paramount, as phishing is often the initial entry point.
• Endpoint Detection and Response (EDR): Advanced EDR solutions capable of detecting suspicious process injections, memory anomalies, and unusual network activity are vital for identifying and mitigating these threats at the endpoint level.
• Protocol Security: While FTP is an older protocol, understanding its potential for abuse and implementing appropriate access controls and monitoring is essential.

SOCRadar’s report provides crucial indicators of compromise (IoCs) that can assist cybersecurity professionals in identifying the malicious infrastructure and detecting infected machines within their networks. These IoCs typically include malicious IP addresses, domain names, file hashes, and specific registry keys or file paths associated with the malware. By leveraging these IoCs, organizations can proactively hunt for and remove these threats.

The continued innovation in malware delivery and command-and-control techniques highlights the ongoing arms race between cybercriminals and defenders. The ability of threat actors to repurpose seemingly benign aspects of network protocols, such as FTP banners, serves as a stark reminder that cybersecurity requires constant vigilance, adaptation, and a deep understanding of emerging threats. Organizations are advised to stay informed about the latest threat intelligence and to regularly review and update their security architectures to counter these sophisticated attacks.