E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands
Threat actors are using FTP banners as dead drop resolvers (DDRs) for the first time in the wild, embedding C2 commands within the initial protocol response instead of relying on traditional web-based DDRs Two previously unreported RATs, E4del and PINHOLE, are being delivered through this novel technique, with E4del masquerading as a signed Discord Electron app and PINHOLE leveraging high-reputation platforms like Pinterest and SurveyMonkey PINHOLE employs advanced evasion techniques including H
Analysis
TL;DR
- Threat actors are using FTP banners as dead drop resolvers (DDRs) for the first time in the wild, embedding C2 commands within the initial protocol response instead of relying on traditional web-based DDRs
- Two previously unreported RATs, E4del and PINHOLE, are being delivered through this novel technique, with E4del masquerading as a signed Discord Electron app and PINHOLE leveraging high-reputation platforms like Pinterest and SurveyMonkey
- PINHOLE employs advanced evasion techniques including Halo's Gate, six layers of unpacking, and Early Bird APC Injection to execute payloads inside suspended legitimate processes, bypassing conventional AV/EDR detection
- E4del features a dynamic tiered jitter beaconing system with three states (Active, Semi-Active, Inactive) that adjusts check-in frequency from 200ms to 9 seconds based on elapsed time since last command
- Attackers maintain an FTP Stats Panel to monitor campaign performance metrics including execution success rates, total connections, and unique IP addresses interacting with their FTP infrastructure
Why It Matters
This represents a significant evolution in malware delivery tactics, as threat actors are now abusing a fundamental network protocol's initial handshake to resolve C2 infrastructure—bypassing traditional web-based DDR detection mechanisms that security tools are heavily tuned to monitor. The technique highlights how legacy protocols like FTP, often overlooked in modern security architectures, can be weaponized for sophisticated multi-stage attacks, urging practitioners to expand detection strategies beyond HTTP/HTTPS-based dead drops to include protocol-level anomalies.
Technical Details
- FTP Banner as DDR: Malware stagers connect to FTP servers and extract next-stage commands directly from the banner response sent upon connection, eliminating the need for HTTP-based C2 resolution in the initial stage
- E4del RAT: A Node.js-based remote access trojan embedded within a digitally signed Electron application impersonating Discord; supports reverse shell, screenshot capture, desktop streaming, file operations, and encrypted C2 communication with a three-state tiered jitter beaconing system
- PINHOLE RAT: More advanced payload utilizing MSXML2.XMLHTTP COM object in PowerShell to fetch secondary scripts from Cloudflare-proxied domains; employs Halo's Gate technique, six-layer unpacking to extract an 119 KB native x86-64 PE executable, and Early Bird APC Injection into suspended child processes
- PINHOLE Capabilities: 14 distinct commands including file enumeration, recursive search, exfiltration, process termination by PID, screenshot capture, PowerShell execution via anonymous pipes, and a browser stealer module
- Attack Chains: Spanish-language voucher lure LNK files trigger FTP banner command retrieval leading to WebDAV-based DLL execution via rundll32.exe; a separate chain uses FTP banner commands to execute PowerShell that downloads and extracts a ZIP archive containing E4del
Industry Insight
Security teams should expand network monitoring and anomaly detection to include FTP traffic analysis, as legacy protocol abuse is increasingly becoming a vector for initial C2 resolution—traditional web-centric DDR detection is no longer sufficient. The adoption of Early Bird APC Injection and multi-layer unpacking by PINHOLE indicates a growing trend toward process hollowing-adjacent techniques that specifically target EDR behavioral signatures, suggesting defenders must prioritize memory-level detection and suspended process monitoring. The existence of an FTP Stats Panel for campaign analytics demonstrates that threat actors are treating these novel delivery mechanisms as measurable operations, implying this technique will likely be refined and adopted by additional actor groups in the near term.
Disclaimer: The above content is generated by AI and is for reference only.