Full Report
Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) tracked as E4del and PINHOLE. While threat actors are known to abuse legitimate services to point to additional command-and-control (C2) infrastructure and blend in with regular network traffic, the development
Analysis Summary
# Tool/Technique: FTP Banner Dead Drop Resolvers (DDR) & E4del / PINHOLE RATs
## Overview
This attack campaign utilizes a novel technique where threat actors abuse **FTP banners** (the initial welcome text sent by an FTP server) as **Dead Drop Resolvers (DDRs)**. These banners store malicious commands or C2 addresses, allowing malware stagers to fetch instructions immediately upon connection. The campaign serves two previously undocumented Remote Access Trojans (RATs): **E4del** and **PINHOLE**.
## Technical Details
- **Type:** Malware Family (RATs) and Evasion Technique (FTP DDR)
- **Platform:** Windows (utilizes LNK files, PowerShell, and Node.js/Electron)
- **Capabilities:** Command execution, defense evasion (Halo's Gate), dynamic beaconing, and remote surveillance.
- **First Seen:** Early July 2026 (first reported activity)
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- [T1102.001 - Web Service: Dead Drop Resolver] (Modified for FTP Banners)
- [T1140 - Deobfuscate/Decode Files or Information]
- [T1055.004 - Process Injection: APC Injection] (Early Bird APC Injection)
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols] (WebDAV, Cloudflare Workers)
- [T1071.002 - Application Layer Protocol: File Transfer Protocols] (FTP Banner Abuse)
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link File]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
## Functionality
### Core Capabilities
* **FTP-Based Staging:** Uses FTP welcome banners to host initial PowerShell commands, bypassing traditional URL-based filtering.
* **Tiered Beaconing (E4del):** Implements a dynamic jitter system with three states (Active, Semi-Active, Inactive) to mimic normal network noise.
* **Persistence:** Establishes long-term access via registry keys or startup folders (typical of RAT behavior).
* **E4del Features:** Interactive reverse shell, screenshot capture, live desktop streaming, and file exfiltration.
### Advanced Features
* **Halo’s Gate Technique:** Used by PINHOLE to bypass EDR/AV by dynamically resolving system calls to avoid hooked functions.
* **High-Reputation DDRs:** PINHOLE abuses Pinterest and SurveyMonkey as secondary resolvers to find C2 infrastructure.
* **Social Engineering (ClickFix):** Utilizes fake CAPTCHA and voucher lures in Spanish to trick users into running commands.
* **Cloudflare Workers:** Used as a proxy layer to hide the true origin of C2 communication.
## Indicators of Compromise
- **File Names:** `u.cmd` (Temporary script), Discord-masquerading Electron apps.
- **Network Indicators:**
- `157.254.194[.]31` (FTP DDR)
- `167.148.41[.]164` (Secondary FTP DDR)
- `209.99.185[.]38` (FTP DDR for PINHOLE)
- `cloudflare.milicare[.]in` (C2/Script source)
- **Behavioral Indicators:**
- `rundll32.exe` spawning from `conhost.exe` to execute WebDAV-hosted DLLs.
- Unusual FTP traffic (port 21) where no file transfer occurs, only banner exchange.
- PowerShell using `MSXML2.XMLHTTP` to fetch remote scripts.
## Associated Threat Actors
- **Cluster:** Currently unassigned/unknown (linked to campaigns similar to ClickFix/ClearFake).
## Detection Methods
- **Signature-based:** Detect LNK files pointing to FTP connection strings.
- **Behavioral:** Monitor for `powershell.exe` making outbound connections to port 21. Flag `rundll32.exe` loading modules directly from WebDAV paths (`\\http...`).
- **Network:** Inspect FTP banner traffic for encoded PowerShell commands or suspicious URLs.
## Mitigation Strategies
- **Network Filtering:** Block outbound FTP (Port 21) for standard workstations that do not require it for business functions.
- **Endpoint Hardening:** Disable or restrict `rundll32.exe` and `cmd.exe` from processing files directly from WebDAV/UNC paths.
- **User Training:** Educate users on "ClickFix" lures, specifically fake CAPTCHAs that request users to paste commands into their terminal.
## Related Tools/Techniques
- **ClearFake / ClickFix:** Shared social engineering TTPs.
- **WordlistLoader / Amatera Stealer:** Often deployed via similar WebDAV delivery chains.
- **Early Bird APC Injection:** The process injection method used for final payload execution.