E4del and PINHOLE RATs Exploit FTP Banners as Dead Drop Resolvers

Cybersecurity researchers have uncovered a campaign in which FTP banners serve as dead drop resolvers to deliver the previously unreported remote access trojans E4del and PINHOLE. According to The Hacker News, the threat actors abuse legitimate FTP services by embedding C2 commands and configuration data within the server banner text that appears when a client connects. When infected systems retrieve or parse these banners, they extract hidden malware commands, enabling remote access and control.

The use of FTP banners as DDRs allows the malware to conceal C2 infrastructure within a protocol commonly found in enterprise environments, reducing the likelihood of detection through superficial traffic analysis. The E4del and PINHOLE RATs provide threat actors with remote access capabilities, though specific technical details of their payloads, propagation methods, and full capability sets remain under investigation.

The exact attribution of the campaign, the total number of affected victims, and the geographical scope of the FTP servers being abused are not confirmed in the reporting. The technique represents a novel abuse of a standard internet protocol to evade security controls that typically focus on payload detection rather than inspection of protocol-specific metadata such as banners.