E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands
Summary: SOCRadar researchers documented a campaign using FTP banners as dead drop resolvers to deliver two previously unreported RATs, E4del and PINHOLE, marking the first time this technique has been seen in the wild. One chain uses Spanish-language voucher lures to run a Windows Shortcut that pulls commands from an FTP banner at 157.254.194[.]31:21, which fetches a second banner from 167.148.41[.]164:21 and ultimately delivers E4del, a Node.js RAT embedded in a digitally signed Electron app posing as Discord.
Bottom line: The operators built an FTP Stats Panel at 69.48.228[.]126:5000 to track script executions, total connections, and unique active or blocked IPs against their infrastructure, and at analysis time it showed only 11 execution events - a campaign still in its infancy, with PINHOLE already using Pinterest, SurveyMonkey, and Cloudflare Workers as resolvers and six unpacking layers plus Early Bird APC injection to reach a 119 KB payload.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026