# When the Greeting Is the Payload: Inside the FTP Banner Trick Dropping Two New RATs
The FTP handshake was never supposed to be a weapon. Before a client even authenticates, the server sends a banner — a simple text greeting, the digital equivalent of a "welcome" mat. Attackers have now figured out that the mat can carry instructions.
SOCRadar's threat intelligence team published research this week documenting a live campaign that embeds malicious commands directly inside FTP server banners, using them as what the industry calls a dead-drop resolver (DDR): a staging mechanism to relay instructions without hosting obvious malware on attacker infrastructure. The result is two previously undocumented remote access trojans, E4del and PINHOLE, built with very different philosophies but connected by the same clever abuse of a protocol that's been around since 1971.
## The Infection Chain
It starts mundanely: a ZIP file, probably delivered by phishing, containing an LNK shortcut. The LNK connects to an attacker-controlled FTP server, but the payload isn't sitting in a directory waiting to be downloaded. It's in the banner — the text the server sends before the client logs in. A PowerShell stager reads that greeting, parses out the embedded commands, and execution begins from there.
SOCRadar confirmed the technique has been live since at least early July 2026, with new infrastructure appearing as recently as this month. MalwareHunterTeam spotted it first during an unrelated investigation. Two separate infection routes branch off from this entry point, each delivering a different RAT.
## E4del: Discord in a Suit
E4del is the noisier of the two. It's a Node.js-based RAT bundled inside a digitally signed Electron application that impersonates Discord — a choice that's not accidental. Electron apps are enormous by nature, which means the malicious payload gets lost in the noise of a runtime environment that legitimately pulls in gigabytes. The digital signature adds another layer of plausibility at the endpoint level.
Functionally, E4del is capable: persistent and temporary shell access, screenshot capture, live desktop streaming over WebSockets, and arbitrary payload download-and-execute. SOCRadar also found a native Node.js module called crypto32.node that appears to handle privilege escalation, though the researchers couldn't retrieve it for full analysis at publication time — meaning that capability remains a partial unknown.
The Discord masquerade is a well-worn tactic, but the FTP-banner staging mechanism feeding the infection chain is what earns this campaign attention.
## PINHOLE: The Patient One
PINHOLE is the more technically interesting piece of work. Its C2 configuration isn't pulled from a dedicated server or even a sketchy domain — it's retrieved from Pinterest pins and SurveyMonkey survey questions. If that sounds absurd, that's the point. Traffic to Pinterest and SurveyMonkey blends invisibly into normal enterprise network patterns. Security tools that flag connections to known-bad infrastructure have nothing to flag here.
The malware's memory behavior is equally deliberate. PINHOLE uses shellcode fluctuation to keep only a 4KB section of its payload in memory at any given moment, rotating through the shellcode rather than loading it all at once. That's a specific countermeasure against memory scanning, and it's not common in commodity malware. The final payload injects into a suspended ApplicationFrameHost.exe process via Early Bird APC injection — a technique that inserts shellcode before the thread's main entry point executes, making behavioral detection substantially harder.
PINHOLE supports 14 commands covering the standard RAT playbook: file enumeration, upload/download, command execution, process management, screenshots, and a browser credential stealer module.
At the time SOCRadar analyzed it, PINHOLE had logged only 11 execution events. This is almost certainly a campaign in early rollout, not a mature operation.
## Why FTP Banners, and Why It's Still a Trade-Off
Legitimate web services — Twitter, GitHub, YouTube, Pastebin — are the usual choice for DDR because they carry massive volumes of traffic that makes individual connections invisible. FTP to an unknown external server is a different signal entirely. Most organizations don't have legitimate business reasons for outbound FTP connections to random IP addresses, and any mature network monitoring setup should be raising eyebrows.
SOCRadar flags this explicitly: FTP-based DDR is less stealthy than web-based alternatives. So why use it? Flexibility, primarily. FTP banner content can be changed server-side without modifying the malware binary. The stager just reads whatever greeting it gets. That makes the technique adaptable — SOCRadar notes it could be repurposed for ClickFix-style social engineering campaigns where user interaction triggers the banner connection.
The researchers have published indicators of compromise covering both the malicious FTP infrastructure and signs of infection on endpoints.
---
## HackWire Analysis
The FTP banner technique is genuinely novel, but the more important story here is PINHOLE's C2 design. Using Pinterest and SurveyMonkey as configuration hosts represents a meaningful evolution of the legitimate-service-abuse pattern that's been building for several years. We've seen this with Telegram, GitHub Gists, and Google Docs — but those have become well-understood threat vectors that many security teams monitor. Consumer platforms like Pinterest and SurveyMonkey sit in a weird middle ground: they're trusted enough that blocking them would create operational noise, but obscure enough that few teams are actively parsing their traffic for embedded C2 configs.
This matters now because the campaign appears to be in early stages — 11 executions is almost pre-deployment testing. Organizations have a window here. The IOCs SOCRadar published are worth ingesting immediately, and network defenders should specifically look at whether outbound FTP connections to non-business-critical servers are being flagged anywhere in their telemetry. They almost certainly aren't.
The Discord masquerade in E4del is also worth naming as a persistent organizational risk. Electron apps are a known delivery vehicle precisely because they're enormous, often signed, and carry legitimate-looking metadata. Enterprises that permit personal-use applications like Discord on managed endpoints are accepting broader attack surface than they typically model. That's not a new problem, but this campaign illustrates concretely how it gets exploited.
The broader pattern: attackers are spreading their infrastructure bets. One campaign, two RATs, at least three different C2 mechanisms (FTP banners, Pinterest, SurveyMonkey). Each component has its own resilience. Defenders who focus on IOC matching alone will never keep pace with campaigns built this way.
— HackWire Editorial
---
## Related Coverage