Full Report
Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. [...]
Analysis Summary
# Tool/Technique: FTP Banner Dead-Drop Resolving (DDR)
## Overview
This technique involves abusing the text strings (banners) sent by FTP servers during the initial connection greeting to store and deliver malicious commands. By connecting to a rogue or compromised FTP server, a malware stager can read the banner—which typically contains version information—to extract obfuscated PowerShell scripts or C2 instructions without needing to complete a formal login process.
## Technical Details
- **Type**: Technique / Dead-Drop Resolver (DDR)
- **Platform**: Windows (observed payloads target Windows environments)
- **Capabilities**: Command delivery, payload staging, and bypassing traditional web-based URL filters.
- **First Seen**: July 2026
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1102.001 - Web Service: Dead Drop Resolver (Modified for FTP)
- T1564 - Hide Artifacts
- T1027 - Obfuscated Files or Information
- **TA0011 - Command and Control**
- T1132 - Data Encoding
- T1071.002 - Application Layer Protocol: File Transfer Protocol
## Functionality
### Core Capabilities
- **Command Hosting**: Leverages the FTP server's greeting message to host a PowerShell script.
- **Initial Access**: Delivered via ZIP archives containing malicious .LNK files (likely via phishing).
- **Stealth**: Uses legitimate-sounding FTP response codes to blend into network traffic (though less effective than HTTPS-based DDRs).
### Advanced Features
- **Low Footprint**: Used to initiate chains for memory-only payloads.
- **Infrastructure Versatility**: Can be weaponized across any FTP server the actor controls or compromises.
---
# Malware Family: E4del
## Overview
E4del is a previously undocumented Node.js-based Remote Access Trojan (RAT) packaged as a digitally signed Electron application. It frequently masquerades as the Discord application to evade suspicion.
## Technical Details
- **Type**: Malware family (RAT)
- **Platform**: Windows (Electron-based)
- **Capabilities**: Shell access, screen capture, desktop streaming.
- **First Seen**: July 2026
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0009 - Collection**
- T1113 - Screen Capture
- **TA0004 - Privilege Escalation**
- T1068 - Exploitation for Privilege Escalation (via *crypto32.node*)
## Functionality
### Core Capabilities
- **Command Execution**: Runs commands via persistent or temporary shells.
- **File Transfer**: Downloads and executes additional payloads from the C2.
- **Data Collection**: Captures screenshots and provides live desktop streaming over WebSockets.
### Advanced Features
- **Privilege Escalation Module**: Includes a specific Node.js module named `crypto32.node` designed for escalating system privileges.
- **Signed Binary**: Uses digital signatures to bypass basic security software checks.
---
# Malware Family: PINHOLE
## Overview
PINHOLE is a sophisticated, highly evasive RAT designed to maintain a minimal memory footprint. It utilizes external social media and survey platforms for C2 configuration, a technique that provides high resilience against takedowns.
## Technical Details
- **Type**: Malware family (RAT)
- **Platform**: Windows
- **Capabilities**: Stealthy execution, credential theft, file management.
- **First Seen**: July 2026
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1055.004 - Process Injection: Asynchronous Procedure Call (Early Bird APC)
- T1622 - Debugger Evasion (Shellcode Fluctuation)
- **TA0011 - Command and Control**
- T1102 - Web Service (Pinterest, SurveyMonkey)
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers
## Functionality
### Core Capabilities
- **C2 Resilience**: Retrieves configuration data from Pinterest pins and SurveyMonkey survey questions.
- **Command Set**: Supports 14 distinct commands including file enumeration, process management, and file upload/download.
- **Information Theft**: Dedicated module for stealing stored browser credentials.
### Advanced Features
- **Shellcode Fluctuation**: Keeps only one 4KB section of the payload active in memory at a time to evade memory scanners.
- **Early Bird APC Injection**: Injects the final assembly into a suspended `ApplicationFrameHost.exe` process.
---
## Indicators of Compromise
- **File Names**: `ApplicationFrameHost.exe` (target for injection), `crypto32.node`.
- **Network Indicators**:
- FTP servers used as DDRs (Contact SOCRadar for specific IPs).
- Pinterest[.]com (C2 configuration).
- SurveyMonkey[.]com (C2 configuration).
- **Behavioral Indicators**:
- Outbound FTP connections to unusual external IP addresses without authentication.
- PowerShell execution initiated via .LNK files.
- Suspicious WebSocket traffic originating from Electron-based apps.
## Associated Threat Actors
- Unknown (Campaign currently in early stages as of August 2026).
## Detection Methods
- **Behavioral Detection**: Monitor for `ApplicationFrameHost.exe` spawned in a suspended state or receiving APC injections.
- **Network Detection**: Flag outbound FTP traffic (Port 21) that does not involve standard login sequences (USER/PASS) but results in PowerShell execution.
- **Signature-based**: Scan for the `crypto32.node` module and Electron applications masquerading as Discord with unusual digital signatures.
## Mitigation Strategies
- **Network Hardening**: Restrict outbound FTP (Port 21) to known-good business servers only.
- **User Training**: Educate users on the dangers of opening ZIP files and .LNK files from untrusted sources (phishing).
- **Endpoint Security**: Enable Attack Surface Reduction (ASR) rules to block executable content from email and block process injections.
## Related Tools/Techniques
- **ClickFix**: Social engineering campaigns (potential adaptation mentioned).
- **Traditional DDRs**: GitHub, X (Twitter), and YouTube-based command hosting.