1. Basic Information Article Title : FTP Banners: The New Dead Drop Resolver Delivering Novel RATs Publisher : SOCRadar Threat Research Unit Publication Date : 2026-08-21 Update Date : None Severity : High Original Source : SOCRadar Threat Research Unit Related Source : Hackers abuse FTP server banners to deliver new Windows malware Related Entities : malware: E4del, PINHOLE groups: None cves: None products: Windows, FTP, Pinterest, SurveyMonkey, Cloudflare Workers, Electron 2. Executive Summary Attackers embed PowerShell commands into the greeting messages (banners) returned by FTP servers before login, and deliver two types of RATs via LNK files. 3. Attack Flow 1. Common Entry The user opens an LNK file inside a ZIP archive. The LNK file connects to an FTP server and gets PowerShell commands from the pre-login greeting message (banner). The retrieved commands start the delivery chain for E4del or PINHOLE. 2. E4del A signed Electron app runs and looks like Discord. A Node.js RAT provides persistent/temporary shells, screen capture, WebSocket live streaming, and extra file execution. crypto32.node is described as a privilege escalation feature, but researchers could not recover it to confirm actual behavior. 3. PINHOLE A multi-stage loader resolves encrypted C2 settings from Pinterest and SurveyMonkey. It connects to the C2 via Cloudflare Workers to get the next stage. It starts ApplicationFrameHost.exe in a suspended state and injects the final RAT using Early Bird APC. It performs file operations, command execution, screen capture, and browser credential theft. 4. Attacker Infrastructure and Execution Locations Uses FTP server banners as dead drop storage. Relays PINHOLE C2 traffic through Cloudflare Workers. Abuses Pinterest and SurveyMonkey to store C2 location info. Disguises malware as legitimate Electron / ApplicationFrameHost.exe on infected Windows devices. 5. Visibility for Victims and Administrators Victims Little action is needed other than opening the shortcut inside the ZIP. E4del may look like Discord, and PINHOLE may look like an update tool. Administrators / SOCs Observe unknown FTP connections without authentication, followed immediately by PowerShell. See APC injection into ApplicationFrameHost.exe , Cloudflare Workers traffic, and Alternate Data Stream (ADS) settings storage. 6. Success and Failure Conditions Success Conditions The user opens the LNK file. The device allows network traffic to unknown FTP servers. PowerShell and multi-stage payload execution are not blocked. Traffic to legitimate web services and Cloudflare Workers is allowed. Failure Conditions Block ZIP and LNK files at the email and web gateways. Block outbound FTP traffic that is not needed for business. Detect and block LNK-initiated PowerShell and process injection. Correlate abnormal traffic from Pinterest and SurveyMonkey to Cloudflare Workers. 7. What Happens on Success Remote shell and arbitrary command execution Screen capture and live streaming File sending and receiving Theft of browser-saved credentials Additional payload execution 8. Observable Logs Email ZIP/LNK attachments or download URLs Initial intrusion is likely phishing, but not confirmed Proxy / SWG / DNS FTP connections to unknown IPs Continuous traffic to Pinterest, SurveyMonkey, workers.dev , and nokierojotiarmx.com Endpoint / EDR LNK → PowerShell Electron / Node.js disguised as Discord Suspension and startup of ApplicationFrameHost.exe with APC injection %TEMP%\calc.exe , ADS, and HKCU Load persistence Identity / IdP No direct IdP abuse mentioned in the article PINHOLE steals browser-saved credentials SaaS / Cloud Pinterest pins and SurveyMonkey questions used for C2 resolution Cloudflare Workers used as a C2 proxy Network Long text and PowerShell commands in FTP 220 banners HTTP traffic to /api/health , /api/client , /api/tsk , /api/fls , etc. 9. Attack Success Determination Attack Attempt Observed (Success Unconfirmed) : ZIP/LNK delivered only, no file opened and no FTP connection. User Action Confirmed : Opening the LNK file or the first connection to an unknown FTP server is confirmed. Initial Execution Confirmed : PowerShell and loader execution confirmed after retrieving the FTP banner. Malware Execution or Auth Success Confirmed : E4del/PINHOLE C2 registration and task retrieval confirmed. Data Theft or Session Compromise Confirmed : Transmission of browser credentials, screens, files, and command results confirmed. 10. Investigation Playbook Trigger LNK-initiated FTP connection and PowerShell Listed IOCs or ApplicationFrameHost.exe injection Initial Check Identify the source of the ZIP/LNK and the execution user Preserve the 220 banner if FTP PCAP is available Endpoint Investigate Electron/Node.js, calc.exe , ADS, and HKCU Load Preserve the injector process and memory Authentication / Cloud Change browser-saved credentials Check access to Pinterest, SurveyMonkey, and Cloudflare Subsequent Activity Check for RAT commands, file transfers, and additional payloads Search across endpoints for connections to the same FTP destination Containment Isolate the endpoint, block FTP and C2, change credentials Consider rebuilding after removing persistence and extra files Assessment Levels Contact only LNK execution Loader execution RAT C2 established Data theft confirmed 11. Defense and Detection Ideas Single Event Connection from a business device to an unknown FTP server PowerShell as a child of an LNK file APC injection into ApplicationFrameHost.exe Timeline Correlation LNK → FTP 220 response → PowerShell → Electron or calc.exe Pinterest / SurveyMonkey → workers.dev → C2 API Threat Hunting Perspective PowerShell strings in FTP banners ADS in desktop.ini and HKCU Windows Load Listed hashes, paths, and domains Log Gaps Network logs that keep the FTP banner body Process injection telemetry Visibility into content within legitimate web services Priority Countermeasures Control LNK and ZIP files Block outbound FTP not required for business Detect scripts and APC injection 12. Facts / Inference / Hypothesis Facts SOCRadar confirmed activity using FTP banners as Dead Drop Resolvers starting in early July 2026. E4del and PINHOLE are novel RATs delivered through separate paths. PINHOLE gets C2 info from Pinterest and SurveyMonkey and relays it through Cloudflare Workers. PINHOLE script execution records were 11 at the time of analysis. Inference Unknown FTP connections stand out more than typical web-based DDRs, making them relatively easy to detect if outbound logs exist. Hypothesis The same FTP banner method can be reused for ClickFix, but the LNK path was the only one actually observed in the article. 13. MITRE ATT&CK Mapping T1566.001 Phishing: Spearphishing Attachment (Confidence: Medium) T1204.002 User Execution: Malicious File (Confidence: High) T1102.003 Web Service: One-Way Communication (Confidence: Medium) T1055.004 Process Injection: Asynchronous Procedure Call (Confidence: High) T1059.001 PowerShell (Confidence: High) T1555.003 Credentials from Web Browsers (Confidence: High) 14. Unknowns and Additional Investigation Full content of the initial delivery email Attacker attribution and ultimate objective Actual privilege escalation capability of E4del crypto32.node 15. Impact on SOCs and Organizations In organizations where FTP is not normally used, the combination of outbound FTP and LNK-initiated PowerShell serves as a strong detection rule. Security teams should analyze contextual relationships and process behavior rather than blocking legitimate web services entirely. 16. Summary by Target Audience For SOCs Monitor the chain of FTP banner content, LNK to PowerShell, and Pinterest/SurveyMonkey to Workers. For Administrators Block unnecessary FTP traffic, and control LNK files, scripts, and process injection. For Users Do not open shortcuts inside ZIP files, and check with the sender through another channel.