Full research report

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

The FTP-banner dead drop resolver technique is a genuine novelty: commands are embedded in the pre-authentication greeting text an FTP server sends before any login, allowing a malware stager to receive instructions without making a conventional HTTP or DNS-based C2 request. SOCRadar's infrastructure investigation, seeded by MalwareHunterTeam's July 2026 observation, uncovered two distinct RATs exploiting this delivery primitive in parallel chains. E4del's Electron/Node.js construction and Discord impersonation point to a focus on blending into developer or gaming environments, while PINHOLE's native PE architecture, six-layer unpacking, memory-resident shellcode fluctuation and C2 resolution via Pinterest and SurveyMonkey indicate a more operationally mature concern for resilience and detection evasion. The campaign's low execution telemetry — 11 events for PINHOLE at analysis time — suggests either highly targeted deployment or infrastructure in a testing phase. The WebDAV and ClickFix overlap with ClearFake is notable but unconfirmed as same-operator activity, and no attribution has been established for either RAT family.

What happened

SOCRadar's Threat Research Unit, following an initial observation by MalwareHunterTeam in early July 2026, documented a campaign that abuses FTP server greeting banners as dead drop resolvers to deliver malware commands — a technique not previously observed in the wild. Investigation of the identified infrastructure uncovered two previously undocumented Windows remote access trojans designated E4del and PINHOLE, each with distinct delivery chains. The campaign was confirmed active into August 2026, with new infrastructure observed that month. No threat actor has been attributed.

Affected scope

Windows systems broadly; no specific sectors or named organisations identified. Spanish-language social engineering lures (voucher claims) indicate Spanish-speaking users as a primary target population. PINHOLE's infrastructure stats panel recorded only 11 execution events at time of analysis, suggesting limited or highly targeted reach.

Technical assessment

E4del is delivered via a ZIP or LNK chain that retrieves chained FTP banner commands, then uses WebDAV to fetch and execute a DLL via rundll32.exe within conhost. The final payload is a Node.js RAT embedded in a digitally signed Electron application impersonating Discord, implementing a three-state tiered jitter beaconing system to blend with normal traffic. PINHOLE follows a separate FTP-banner chain, using PowerShell via MSXML2.XMLHTTP COM object to receive a second stage, which unpacks a 119KB native x86-64 PE through six layers and injects it into a suspended ApplicationFrameHost.exe via Early Bird APC injection. Shellcode fluctuation keeps only 4KB of payload in memory at once; Halo's Gate is used to bypass security tooling. PINHOLE resolves its C2 via Pinterest pins and SurveyMonkey survey questions proxied through Cloudflare Workers, providing resilience against takedown. WebDAV-based delivery overlaps with the ClearFake cluster (WordlistLoader, Amatera Stealer), though shared-operator status is unconfirmed.

Recommended defensive actions

  1. Block outbound FTP connections (TCP port 21) to all external IPs not on an approved allowlist, and alert on any FTP banner retrieval events in endpoint or network telemetry.
  2. Hunt for LNK files executed from user-writable directories (Downloads, Temp, AppData) that spawn conhost or rundll32 with WebDAV UNC path arguments.
  3. Block the identified malicious FTP infrastructure: 157.254.194[.]31, 167.148.41[.]164, 209.99.185[.]38, and the Cloudflare Workers proxy domain milicare[.]in.
  4. Inspect for signed Electron applications masquerading as Discord or other communication tools found outside standard installation paths.
  5. Monitor ApplicationFrameHost.exe for unexpected child process creation or outbound network connections, as this process is PINHOLE's injection target.

Uncertainties and evidence gaps

  • No threat actor attribution established; campaign origin, sponsorship and objectives remain unknown.
  • The relationship between this campaign and the ClearFake/ClickFix cluster is asserted as infrastructure overlap by reporting, not confirmed as the same operator or campaign.
  • PINHOLE's browser stealer module was documented as present but its functionality was undetermined at time of analysis.
  • The primary SOCRadar STRU technical report was inaccessible for direct verification; all technical detail is drawn from verified secondary coverage.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser interaction required — victim must execute a malicious LNK file delivered via a ZIP archive, likely through phishing or social engineering
ComponentWindows Shell (LNK execution), FTP protocol client handling, WebDAV client, Electron/Node.js runtime, ApplicationFrameHost.exe process space
MechanismMalware stager connects to attacker-controlled FTP servers and reads commands embedded in the server's pre-authentication greeting banner, bypassing C2 detection approaches focused on HTTP, DNS, and web-paste services
ImpactFull remote access including arbitrary command execution, screenshot capture, live desktop streaming, credential theft via browser stealer module, file exfiltration, and additional payload delivery
DetectionOutbound FTP to unknown external IPs; rundll32.exe loading DLLs from WebDAV UNC paths; digitally signed Electron binaries impersonating Discord outside standard installation directories; ApplicationFrameHost.exe establishing unexpected outbound connections
MitigationBlock outbound FTP to non-approved servers; apply network-layer controls on identified malicious IPs and domains; enforce application allowlisting to prevent anomalously signed Electron binaries from executing
Exploitation status

No confirmed active exploitation at scale; PINHOLE's dedicated stats panel recorded only 11 execution events at time of analysis, consistent with an early-stage or narrowly targeted operation; no public exploit code exists for either RAT.

Research process

The investigation began with the THN source article, which established the FTP-banner dead drop resolver technique and identified E4del and PINHOLE as the delivered payloads. Broad search confirmed SOCRadar STRU as the originating technical source, with BleepingComputer and Cyware providing independently verifiable corroboration. Direct access to the SOCRadar primary report was blocked (HTTP 403), so technical detail was drawn from the three verified secondary sources. No CVEs, no government advisories, no threat actor attribution, and only 11 confirmed execution events were found, placing this as an emerging technique with novel tradecraft but limited confirmed impact.

  1. What does the THN source article establish about the technique, payloads, and infrastructure?
    Fetched the THN article at the stated source URL
    thehackernews.com ↗

    Confirmed FTP-banner DDR technique first observed by MalwareHunterTeam in July 2026; E4del is a Node.js/Electron RAT impersonating Discord with tiered jitter beaconing; PINHOLE is a multi-stage native PE using Halo's Gate and Early Bird APC injection, resolving C2 via Pinterest/SurveyMonkey behind Cloudflare Workers; Spanish-language voucher lures; WebDAV overlap with ClearFake cluster; active since July 2026.

    why Establishes all core technical claims, IOCs and infrastructure detail requiring independent corroboration.

  2. What independent sources cover this campaign and are there additional technical or attribution details?
    Searched for E4del PINHOLE RAT FTP banner dead drop resolver 2026

    SOCRadar STRU is the originating research source; BleepingComputer, Cyware, SC Media and others carried independent coverage; MalwareHunterTeam credited with first public observation; no government advisory identified.

    why Multiple independent outlets citing the same primary source provides corroboration; BleepingComputer and Cyware are authoritative secondary sources warranting direct verification.

  3. Does BleepingComputer independently corroborate the technical claims and add detail?
    Fetched BleepingComputer article
    bleepingcomputer.com ↗

    Consistent with THN account; added that PINHOLE injects into suspended ApplicationFrameHost.exe via Early Bird APC injection and uses shellcode fluctuation keeping only 4KB in memory at once; 11 execution events confirmed; no attribution provided.

    why Second independent verified domain corroborating technique and adding process injection and memory stealth detail, strengthening confidence in the technical assessment.

  4. Does Cyware corroborate the campaign timeline and scope, and are any government advisories present?
    Fetched Cyware daily threat intelligence briefing for 21 August 2026
    cyware.com ↗

    Confirmed early July 2026 detection date, 11 PINHOLE execution events, consistent technical description, no attribution; no CISA or CERT advisory found.

    why Third independent verified domain corroborating timeline and scope; absence of a government advisory is consistent with no CVE and limited observed exploitation.

  5. Does PINHOLE's use of Pinterest and SurveyMonkey as C2 resolvers have prior precedent or additional documented detail?
    Searched for PINHOLE RAT Pinterest SurveyMonkey C2 FTP banner SOCRadar 2026

    No additional technical sources beyond those already identified; use of legitimate web services as DDRs is consistent with known tradecraft in other families but PINHOLE is a newly documented family with no prior reporting.

    why Confirms novelty of the specific payload and rules out any prior reporting that might alter the assessment; contextualises the technique within known DDR tradecraft without overstating the finding.

Named in this story
Actorsunknown — no attribution established
MalwareE4delPINHOLEWordlistLoaderAmatera Stealer
TargetsWindows users — Spanish-language voucher-claim lures indicate Spanish-speaking population as initial target; broader scope undetermined

Research coverage

All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 67 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok10 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok10 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1676 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5332 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok7970 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve failed0 records Failed The current collection attempt failed; this source cannot support the report.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Analysis & research3
Hackers abuse FTP server banners to deliver new Windows malware — BleepingComputer bleepingcomputer.com ↗

Independent corroboration confirming PINHOLE's Pinterest/SurveyMonkey C2 mechanism, Early Bird APC injection into ApplicationFrameHost.exe, and 11-execution-event scope

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands — The Hacker News thehackernews.com ↗

Detailed secondary coverage citing SOCRadar STRU as primary source; includes IOCs and E4del tiered-jitter beaconing state machine

Cyware Daily Threat Intelligence — 21 August 2026 cyware.com ↗

Third independent domain corroborating July 2026 campaign start date, 11 execution events and absence of attribution