Hackers abuse FTP server banners to deliver new Windows malware

Summary

Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans, E4del and PINHOLE. This technique, observed since early July 2026, uses shortcut files and FTP banners as dead-drop resolvers to retrieve commands. E4del is a Node.js-based RAT disguised as Discord, while PINHOLE retrieves C2 configurations from platforms like Pinterest and SurveyMonkey.

Full text

Hackers abuse FTP server banners to deliver new Windows malware By Bill Toulas August 21, 2026 07:00 AM 0 Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in. By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server. After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use. "By utilizing FOFA searches, we determined that this technique has been weaponized since early July 2026 and remains operational, with new infrastructure observed as recently as August 2026." In a report shared with BleepingComputer, SOCRadar says that the observed attacks start with a ZIP archive that triggers an LNK-based infection chain. The researchers note that the initial compromise likely occurs through phishing. LNK file retrieving data from FTP server bannersSource: SOCRadar The infection chain delivers two remote access trojans (RATs) named E4del and PINHOLE via two distinct infection routes, both retrieving a PowerShell script from FTP banners. E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord. The RAT supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads. SOCRadar also mentions a Node.js module named crypto32.node that attempts privilege escalation, but the researchers could not retrieve it for analysis. The E4del RAT delivery chainSource: SOCRadar PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions, a tactic that offers versatility and resilience to take-downs. The malware leaves a minimal footprint on the host, using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time, and injecting the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers. PINHOLE execution chain and supported commandsSource: SOCRadar At the time of analysis, the PINHOLE script counted only 11 execution events, suggesting that the campaign was in an early stage. While abusing FTP banners to deliver commands is a novel alternative, SOCRadar says that the approach is less stealthy than traditional web-based DDRs (e.g., X, GitHub, YouTube) because FTP connections to unknown servers are more likely to stand out. “While threat actors typically utilize legitimate web services, such as X, GitHub, or YouTube, to provide cover through high-volume, expected network traffic, FTP banners represent a novel alternative." The researchers note that the technique is very versatile and could "easily" be adapted for ClickFix social engineering campaigns. SOCRadar's report provides indicators of compromise that could help defenders identify the malicious infrastructure as well as infected machines on the network. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Fake Roblox Xeno script launcher pushes infostealer, RAT malwareInside the Underground Business of the Android BTMOB RAT malwareNew msaRAT malware uses Chrome, Edge browsers to route C2 trafficAsyncAPI npm packages infected with credential-stealing malwareNew Manic Android malware can exfiltrate data through nearby devices

Indicators of Compromise

• malware — E4del
• malware — PINHOLE

Entities