Threat actors are abusing FTP server banners as dead-drop resolvers to deliver commands that install two previously undocumented remote access trojans, E4del and PINHOLE. The campaign likely begins with phishing-delivered ZIP and LNK files, while PINHOLE and E4del use unusual C2 and execution techniques to maintain access and evade detection. #E4del #PINHOLE #SOCRadar #MalwareHunterTeam
Keypoints
- Attackers hide commands inside FTP banners to control infected systems.
- The campaign uses ZIP archives and LNK files, likely delivered through phishing.
- E4del is a Node.js-based RAT packaged in a signed Electron app that imitates Discord.
- PINHOLE gets C2 data from Pinterest pins and SurveyMonkey surveys.
- SOCRadar says the technique is still active and may adapt to ClickFix campaigns.