Cybersecurity researchers at **SOCRadar** have uncovered a novel and concerning technique employed by threat actors: the abuse of FTP server banners to covertly deliver malicious commands. This method, observed since early July 2026, facilitates the deployment of two new remote access trojans, **E4del** and **PINHOLE**. ### The Anatomy of the Attack The attack typically begins with a ZIP archive, likely delivered via phishing, which triggers an LNK-based infection chain. This chain then instructs the compromised system to connect to an FTP server. Instead of a traditional login, the malware stager extracts commands embedded within the server's initial greeting message – the FTP banner.  This unusual approach allows threat actors to retrieve PowerShell scripts, which then proceed to install either the **E4del** or **PINHOLE** RATs. ### E4del: A Node.js-Based RAT Masquerading as Discord **E4del** is a **Node.js**-based RAT, cleverly packaged within a digitally signed **Electron** application that impersonates **Discord**. Its capabilities are extensive, including: * Executing commands via persistent or temporary shells. * Capturing screenshots and streaming the desktop via **WebSockets**. * Downloading and executing additional payloads. **SOCRadar** also noted a **Node.js** module, `crypto32.node`, attempting privilege escalation, though it could not be fully analyzed.  ### PINHOLE: Evasive and Resilient **PINHOLE** stands out for its unique command-and-control (C2) infrastructure, retrieving configurations from legitimate services like **Pinterest** pins and **SurveyMonkey** survey questions. This tactic enhances its resilience against takedowns and provides a degree of obfuscation. Furthermore, **PINHOLE** is designed for stealth, employing shellcode fluctuation to maintain a minimal footprint. It keeps only a 4KB section of its payload in memory at any given time and injects its final assembly into a suspended `ApplicationFrameHost.exe` process using **Early Bird APC injection**. **PINHOLE** supports 14 commands, enabling: * File enumeration, upload, and download. * Command execution and process management. * Screenshot capture. * Deployment of a module for stealing browser credentials.  At the time of analysis, **PINHOLE**'s execution events were low, suggesting the campaign might still be in its early stages. ### A Novel, Yet Potentially Observable, Approach While the use of FTP banners as a dead-drop resolver is novel, **SOCRadar** suggests it might be less stealthy than traditional web-based alternatives (e.g., **X**, **GitHub**, **YouTube**). FTP connections to unknown servers are more likely to raise flags within network monitoring systems. However, the versatility of this technique is a concern, as it could easily be adapted for other social engineering campaigns, such as **ClickFix**. **SOCRadar**'s comprehensive report provides crucial indicators of compromise (IoCs) to aid defenders in identifying and mitigating this emerging threat. Security professionals are advised to review these IoCs and enhance their network monitoring for unusual FTP activity.