As reported by The Hacker News, security researchers at SOCRadar have documented what appears to be the first in-the-wild abuse of FTP banner messages as dead drop resolvers (DDRs) — a technique that repurposes the welcome text FTP servers send on connection as a covert channel for delivering malware commands. Two previously untracked remote access trojans, E4del and PINHOLE, are at the center of this campaign.

Threat Alert: As reported by The Hacker News, security researchers at SOCRadar have documented what appears to be the first in-the-wild abuse of FTP banner messages as dead drop resolvers (DDRs) — a technique that repurposes the welcome text FTP servers send on connection as a covert channel for delivering malware commands.

This development matters less for its novelty and more for what it reveals about defender blind spots. Most network monitoring and EDR solutions are tuned to detect HTTP/HTTPS-based C2 callbacks, DNS tunneling, and known cloud-service abuse. FTP traffic to unknown external endpoints — especially on port 21 — often falls into a gray zone: it may be logged, but it rarely triggers high-confidence alerts unless explicit egress filtering is in place. Threat actors are clearly mapping those gaps.

Why FTP Banners Are an Attractive C2 Substrate

FTP banners are sent as plaintext in the initial 220 response code before any authentication occurs. An attacker who controls an FTP server can embed arbitrary strings — base64-encoded commands, URLs, or instruction blocks — in that banner. Malware stagers parse the response without ever logging in, making the interaction look like a failed or aborted connection from a network perspective.

The key insight: the C2 instruction never traverses an authenticated session. It lives in a protocol handshake that most logging pipelines discard as noise.

The E4del RAT: Capabilities and Evasion

E4del is a Node.js-based RAT embedded in a digitally signed Electron application spoofing Discord. Its capabilities include:

Why FTP Banners Are an Attractive C2 Substrate
Interactive reverse shell and live desktop streaming
Screenshot capture and file exfiltration
Defense evasion and persistent access mechanisms
Encrypted C2 communication with tiered jitter beaconing that transitions between Active, Idle, and Dormant states to mimic benign traffic patterns

The multi-stage delivery chain observed by SOCRadar chains two FTP banner lookups — the first at 157.254.194[.]31:21 resolving to a second at 167.148.41[.]164:21 — before executing PowerShell to retrieve a ZIP payload. This chaining is designed to complicate static analysis and sandbox detonation.

Who Is at Risk

The initial access vector relies on Spanish-language voucher lures delivered via LNK files, and overlapping activity connects to ClearFake-style ClickFake CAPTCHA decoys. Organizations most exposed include:
  • Spanish-speaking regions and multinational environments with diverse language bases
  • End-user-heavy environments where browser-based social engineering is difficult to control (SMBs, education, hospitality)
  • Environments without strict FTP egress filtering — particularly those that still permit outbound port 21 to arbitrary destinations

Broader Implications

The emergence of FTP banner DDRs signals a continued shift toward protocol-level creativity. As defenders close gaps around DNS and HTTP-based C2, actors will explore any stateful protocol that exchanges metadata before authentication. SMTP banners, SSH greeting strings, and TLS certificate fields are all candidates for similar abuse. This is not a one-off curiosity — it's a preview of the next frontier in C2 evasion.

Shield53 Recommendations

  • Block outbound FTP to non-whitelisted destinations at the perimeter. Port 21 egress to arbitrary IPs should be denied by default in any modern environment.
  • Deploy FTP protocol inspection in your IDS/IPS. Create alerts for FTP 220 responses containing non-standard banner content — especially base64 strings, URLs, or PowerShell indicators.
  • Hunt for the IOCs published by SOCRadar, including the two FTP server IPs and any Electron binaries masquerading as Discord that lack valid code-signing chain verification beyond surface-level checks.
  • Monitor for conhost.exe and rundll32.exe spawning from LNK execution chains, particularly when followed by PowerShell network connections to external endpoints.
  • Reinforce user awareness around voucher-themed and CAPTCHA-spoofing lures. The social engineering layer remains the weakest link, and both E4del and the ClearFake overlap rely on it.
  • Review egress policies holistically — if FTP banner abuse works, other pre-authentication protocol handshakes will follow. Build detection logic now for protocol metadata anomalies, not just session content.