FTP Banners Used to Deliver E4del and PINHOLE Windows RATs
Summary
SOCRadar reports that attackers use FTP server banners as dead-drop resolvers to deliver E4del and PINHOLE RATs. The report details their infection routes, capabilities and evasion techniques, and says the activity continued through August 2026.
Key points
- The campaign uses ZIP archives and LNK files, likely delivered through phishing, to retrieve PowerShell commands from FTP server banners.
- E4del is a Node.js RAT packaged in a signed Electron app masquerading as Discord; it supports command execution, screenshots, desktop streaming and additional payloads.
- PINHOLE retrieves C2 configuration from Pinterest pins and SurveyMonkey surveys.
- PINHOLE uses shellcode fluctuation and Early Bird APC injection into a suspended ApplicationFrameHost.exe process.
- PINHOLE supports 14 commands, including file operations, process management and deployment of a browser-credential-stealing module.
- SOCRadar says the technique remained operational through August 2026; its analysis counted 11 PINHOLE execution events.
Article Details
- Attack Vectors
- The campaign likely begins with phishing-delivered ZIP archives that trigger an LNK-based infection chain.
- The malware retrieves PowerShell commands from FTP server banners used as dead-drop resolvers.
- PINHOLE retrieves C2 configuration from Pinterest pins and SurveyMonkey survey questions.
- E4del is packaged in a digitally signed Electron application that masquerades as Discord.
- Defensive Notes
- Monitor connections to unfamiliar FTP servers and inspect banner responses for embedded commands; SOCRadar notes these connections may be more conspicuous than traffic to common web services.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationE4del is packaged in an application that masquerades as Discord.T1055.004 · Asynchronous Procedure CallPINHOLE injects its final assembly into a suspended ApplicationFrameHost.exe process using Early Bird APC injection.T1059.001 · PowerShellBoth infection routes retrieve a PowerShell script from FTP banners.T1071.002 · File Transfer ProtocolsThe malware retrieves commands through FTP server banner responses.T1102.001 · Dead Drop ResolverPINHOLE retrieves C2 configuration from Pinterest pins and SurveyMonkey survey questions used as dead-drop sources.T1105 · Ingress Tool TransferE4del can download and execute additional payloads.T1113 · Screen CaptureBoth RAT capabilities described include capturing screenshots.T1204.002 · Malicious FileThe reported infection chain uses LNK files to trigger malware delivery.T1555.003 · Credentials from Web BrowsersPINHOLE can deploy a module to steal credentials stored in browsers.T1566.001 · Spearphishing AttachmentThe infection likely begins with phishing-delivered ZIP files and LNK files, according to SOCRadar.
Malware
E4delThreat actors are abusing FTP server banners as dead-drop resolvers to deliver commands that install two previously undocumented remote access trojans, E4del and PINHOLE.PINHOLEThreat actors are abusing FTP server banners as dead-drop resolvers to deliver commands that install two previously undocumented remote access trojans, E4del and PINHOLE.
Products
DiscordE4del is a Node.js-based RAT packaged in a signed Electron app that imitates Discord.Node.jsE4del is a Node.js-based RAT packaged in a signed Electron app that imitates Discord.PinterestPINHOLE gets C2 data from Pinterest pins and SurveyMonkey surveys.SurveyMonkeyPINHOLE gets C2 data from Pinterest pins and SurveyMonkey surveys.