Security researchers have identified an evolving malware delivery tactic in the wild: FTP banner dead drops. Instead of hiding command-and-control details in web pages or scripts, the campaign embeds instructions directly into what an FTP server sends immediately after a connection is made. Using that early protocol response as a “drop,” the attackers deliver two previously undocumented remote access trojans (RATs): E4del and PINHOLE.
The core idea is simple but effective. An FTP banner—often a welcome message or text line—arrives as the very first response of the FTP handshake. Researchers say malware stagers can use this initial banner text to fetch follow-up instructions through the protocol itself. That makes the delivery look more like normal FTP behavior, even though the overall chain is still likely to raise alarms in many environments.
Why FTP banners can act as command dead drops
In typical attack chains, malware retrieves commands from a separate web location or from a dedicated staging server. Here, the protocol greeting becomes the staging layer. When an infected host connects to the attacker-controlled FTP server, the FTP server immediately returns a banner. That banner can include operational commands or pointers that guide the next steps of the infection.
According to reports, this technique was first brought to wider attention earlier through analysis of similar behavior, and it now appears in a more concrete form in the identified campaign. While this approach is creative, it is not necessarily invisible. Many defensive tools flag FTP connections to unknown or suspicious endpoints, meaning the method can be “less stealthy” than web-based dead drop resolvers.
E4del: from FTP banner instructions to an Electron-masquerading RAT
The campaign’s first tracked payload, E4del, is assessed to be a Node.js-based RAT. A notable detail is how it is presented: the RAT is embedded inside a digitally signed Electron application and masquerades as Discord. That social and technical blending is designed to reduce suspicion during execution.
The E4del delivery chain uses multi-stage FTP banner interactions. One described stage references an FTP banner hosted at 157.254.194[.]31:21 (port 21). That banner leads to another FTP banner hosted at 167.148.41[.]164:21, effectively turning one protocol response into a gateway for the next.
In the observed chain, the FTP banner content ultimately triggers PowerShell to download, extract, and run a binary pulled from a ZIP archive. The end result is the deployment of E4del, which then focuses on maintaining access and controlling the infected system.
Dynamic beaconing designed to look like normal traffic
E4del’s command retrieval behavior is described as highly dynamic. Researchers report a tiered jitter mechanism that changes check-in timing to better blend into typical network patterns. In addition, the RAT transitions between three states depending on how much time has elapsed since the last received task.
- Active mode in the first 20 seconds after receiving a command.
- During follow-up checks, the RAT calls home at random intervals between 200 milliseconds and 2 seconds.
- If no new task arrives within 20 to 40 seconds, it enters Semi-Active, lengthening beacon intervals to 2 to 5 seconds.
- After 40 seconds of inactivity, it becomes Inactive, reducing check-ins to 5 to 9 seconds.
This staged timing behavior is intended to make the traffic signature less predictable, which can complicate simple threshold-based detections.
Capabilities: remote control, screenshots, and encrypted C2
Once E4del is running, it supports a range of functions commonly associated with interactive intrusion tooling. Researchers mention defense evasion and persistence features, along with system fingerprinting. It also uses encrypted command-and-control communication to receive operator instructions.
Reported operator-facing capabilities include an interactive reverse shell, screenshot capture, live desktop streaming, file download, and the ability to deliver additional payloads as the campaign progresses.
Shortcut and lure-based steps that lead into FTP banner staging
The attack chain leading into E4del is tied to social engineering. In at least one case, Spanish-language lures related to voucher claims were used to influence users into executing a Windows Shortcut (LNK) file. After that initial execution, the next-stage instructions are retrieved from the FTP banner.
From there, the flow connects to a WebDAV server to download and execute a DLL export using rundll32.exe via conhost. While the initial prompt comes through the LNK social-engineering step, the delivery pivot happens when the malware starts leveraging the FTP banner as the staging source for commands.
ClearFake context: WebDAV plus click-based lures
Researchers also note that a related WebDAV-based approach has appeared in connection with broader campaigns, including a “ClearFake” effort described by Microsoft and Gen Threat Labs. In those cases, WordlistLoader and Amatera Stealer were distributed using ClickFix-style lures.
The cluster associated with these intrusions is also described as compromising legitimate websites and then placing fake CAPTCHA decoys. The goal of those decoys is to push users toward executing malicious steps under the guise of a normal verification flow.
From a defensive standpoint, the key takeaway is that FTP banner dead drops are not isolated. They can be combined with multiple initial access and staging patterns, including shortcut-file phishing and ClickFix-style social engineering.
PINHOLE: a more advanced banner DDR with proxying through Cloudflare Workers
The second RAT in the report, PINHOLE, is assessed as more advanced than the E4del chain. Rather than relying on a straightforward command fetch, PINHOLE uses FTP banner dead drops in a different way: attackers leverage higher-reputation platforms as intermediaries for DDR resolution and then proxy the communication through Cloudflare Workers.
A described FTP banner at 209.99.185[.]38:21 (port 21) contains commands that use the MSXML2.XMLHTTP COM object within PowerShell. That technique retrieves a secondary command script from a URL that routes through the Cloudflare Workers layer. After the script is retrieved, it is written to %TEMP%u.cmd, executed, and deleted to reduce forensic traces.
Execution flow: from a staged wrapper to process injection
The retrieved script acts as a dropper for unpacking and launching the main payload. The first stage uses a wrapper that impersonates an “update utility” from a non-existent company named Weston Computing Systems Ltd.
Researchers also describe the use of Halo’s Gate to bypass security software. Once C2 resolution succeeds, the malware queries a domain for a next-stage payload.
For execution, the campaign proceeds to an Early Bird APC Injection routine. The objective is to run code inside a legitimate process that is created in a suspended state. Before the payload runs, the chain performs multiple unpacking layers to extract a native 119 KB x86-64 PE file. This multi-layer unpacking helps reduce the likelihood that security tools identify the content quickly.
KPMG Israel highlights that this approach extends traditional APC injection by creating a suspended child process and injecting shellcode that is later executed via asynchronous procedure calls. The method aims to evade conventional AV and EDR patterns that expect more typical shellcode signatures.
PINHOLE features: HTTP polling, file operations, and stealthy command handling
After injection, PINHOLE’s RAT functionality comes into focus. Researchers report C2 communication using HTTP GET and POST requests. Through those channels, the malware polls for commands, sends results, and supports file download and upload actions. It can also retrieve a browser-stealer module, though the specifics of that module were not finalized in the analyzed report.
PINHOLE is described as implementing 14 commands for tasks such as enumerating files and directories, exfiltrating files, executing a payload or binary, recursively searching for files, deleting selected files, listing running processes, terminating processes by PID, and taking screenshots.
Beyond basic remote management, it also supports running PowerShell commands and initializing a PowerShell session using anonymous pipes—features that can reduce reliance on additional tooling and keep operator workflows flexible.
Operational tracking: the FTP Stats Panel
In addition to the malware execution chain, attackers appear to maintain operational visibility. A dedicated “FTP Stats Panel” located at 69.48.228[.]126:5000 is described as monitoring campaign success metrics. The panel tracks the number of script executions, total connections, and active or blocked IP addresses interacting with the FTP infrastructure.
At the time of analysis, the panel reportedly showed only 11 execution events, suggesting the campaign may have been in an early phase when the data was collected.
What defenders should take from FTP banner dead drops
From an incident-prevention perspective, FTP banner dead drops represent a notable evolution in how attackers can embed malicious instruction pathways into standard protocols. Even if many organizations block or inspect suspicious FTP traffic, the fact that the earliest FTP server response can carry operational meaning changes how defenders should reason about “where” commands originate.
It’s also important to recognize that the technique is compatible with multiple social-engineering entry points. Shortcut-file phishing and ClickFix-style lures are both mentioned as plausible or observed starting points in related behavior, which means detection efforts should account for both initial access tactics and the follow-up protocol activity.
Ultimately, E4del and PINHOLE demonstrate that the malware ecosystem keeps borrowing from legitimate infrastructure patterns—then repurposes them for command retrieval, timing evasion, and stealthy payload execution.
Conclusion
The discovery of E4del and PINHOLE strengthens the case that attackers are looking beyond classic web-based dead drop resolvers. By turning FTP server banner messages into staged command pathways, criminals can streamline instruction delivery and blend parts of their workflow into routine protocol behavior. Even so, the technique is not guaranteed to be invisible—many security controls are likely to detect abnormal FTP connections.
For defenders, the practical lesson is to treat FTP sessions as more than “just file transfer.” When the FTP banner becomes part of the instruction flow, monitoring and analysis must expand to cover early protocol responses and the full multi-stage chains they can trigger.
Source: https://thehackernews.com/2026/08/e4del-and-pinhole-rats-turn-ftp-banners.html
