As reported by BleepingComputer, threat actors are abusing FTP server banners as dead-drop resolvers to deliver two previously undocumented remote access trojans — E4del and PINHOLE — in a campaign active since at least early July 2026. The tradecraft on display here is not just novel for novelty's sake; each layer is purpose-built to defeat a specific class of security control that most enterprises rely on today.

Threat Alert: As reported by BleepingComputer, threat actors are abusing FTP server banners as dead-drop resolvers to deliver two previously undocumented remote access trojans — E4del and PINHOLE — in a campaign active since at least early July 2026.

Why This Campaign Breaks Legacy Detection

The core innovation is repurposing the FTP greeting banner — the text string a server sends before authentication — as a covert command channel. Because banner retrieval is a standard, pre-authentication FTP handshake behavior, it blends into legitimate protocol traffic. Most IDS/IPS signatures and proxy policies do not inspect banner content for embedded commands, and even if they did, the data looks like an ordinary greeting string to a parser not specifically tuned for it.

This is the dead-drop resolver (DDR) pattern — popularized by APT groups like Turla — adapted to commodity-adjacent tooling. The threat actor maintains a clean FTP server that, to any observer, is simply running an unremarkable service. The malware stager connects, reads the banner, parses out a PowerShell payload URL or command, and proceeds. Takedown becomes a whack-a-mole exercise because the C2 address lives in a mutable text field, not a hardcoded binary string.

The brilliance of this approach is that the C2 infrastructure is indistinguishable from a misconfigured FTP server — there is no malicious payload on the server itself, only a text string.

The Two RATs: Different Threat Profiles

E4del — The Electron-Disguised Node.js RAT

E4del packages itself inside a digitally signed Electron application masquerading as Discord. The digital signature is a critical detail — it implies either a stolen or compromised code-signing certificate or abuse of a signing service. This bypasses application control policies (AppLocker, WDAC) and SmartScreen warnings. Capabilities include persistent and temporary shells, screenshot capture, WebSocket-based desktop streaming, and second-stage payload delivery. A Node.js native module (crypto32.node) is used for privilege escalation, though researchers could not retrieve it for analysis — suggesting it may be selectively delivered or environment-gated.

PINHOLE — The Low-Footprint Information Stealer

PINHOLE is the more operationally sophisticated of the two. It retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions — another dead-drop technique using legitimate, high-reputation platforms that are extremely difficult to block without business impact. Its in-memory footprint is minimal: shellcode fluctuation keeps only a single 4KB section resident at any time, and the final payload injects into a suspended ApplicationFrameHost.exe via Early Bird APC injection. With 14 supported commands including browser credential theft, PINHOLE is purpose-built for espionage and data exfiltration in environments where EDR is present.

Who Is at Risk

Who Is at Risk
Phishing-susceptible environments: Initial access is likely via phishing delivering ZIP archives containing malicious LNK files. Organizations without robust email security and user awareness training are prime targets.
Application-control-reliant shops: If your endpoint hardening strategy leans on AppLocker or WDAC without behavioral EDR, E4del's signed Electron binary will sail through.
Outbound-traffic-restricted networks: PINHOLE's use of Pinterest and SurveyMonkey means C2 traffic flows to legitimate, often-allowlisted domains. Egress filtering alone will not catch this.
Financial services, legal, and R&D-heavy sectors are the most likely targets given the credential theft and desktop streaming capabilities.

What Defenders Must Change

This campaign exposes three blind spots in common defensive architectures:

1. FTP banner inspection is not standard. Most network monitoring tools parse FTP for authentication, file transfer, and directory listing events — not banner content. Defenders should work with their IDS/IPS vendors or internal detection engineering teams to add sigma-like rules that flag FTP banners containing URLs, Base64 strings, or PowerShell-relevant tokens. Even a simple regex for http[s]?:// or pipe-delimited commands in a 220-response would have caught this.

2. Legitimate-platform C2 requires behavioral detection, not blocklists. When C2 config lives in Pinterest pins and SurveyMonkey questions, you cannot block the platform. You can detect the access pattern: unusual frequency of API calls to these platforms from non-browser processes, or from processes running as SYSTEM, is a strong indicator. EDR process lineage — ApplicationFrameHost.exe making outbound HTTPS to api.pinterest.com from a non-interactive session — should be a high-fidelity alert.

3. Code-signing trust is not verification. E4del's signed Electron binary underscores that a valid signature does not mean safe. Defenders should implement certificate reputation checking (e.g., Microsoft Defender SmartScreen V2, or third-party reputation feeds) and alert on signed binaries from publishers with no organizational presence or low certificate age.

Shield53 Recommendations

Immediate Actions

  • Hunt for FTP banner abuse: Query SIEM for FTP 220-response codes exceeding 200 characters or containing URL patterns. Bro/Zeek scripts can be extended to log and inspect banner content. This is the highest-value detection you can implement today.
  • Deploy EDR detection for Early Bird APC injection: Ensure your EDR alerts on thread creation via QueueUserAPC targeting suspended processes, particularly ApplicationFrameHost.exe. Most modern EDR platforms support this via custom rules if not enabled by default.
  • Block and hunt for LNK-based infection chains: Enable Attack Surface Reduction (ASR) rules in Microsoft Defender — specifically the rule to block execution of obfuscated script code and the rule blocking Office apps from creating child processes. Audit for recent .lnk file creation from ZIP extraction in user profiles.
  • Monitor for signed Electron binaries in unexpected locations: Alert on any electron.exe or Electron-packaged executable running from %AppData%, %Temp%, or user-writable directories — especially those claiming to be Discord but not matching Discord's known publisher certificate thumbprint.
  • Hunt for Pinterest/SurveyMonkey C2: Query proxy logs for api.pinterest.com and surveymonkey.com API endpoints accessed by non-browser processes or outside business hours. Pivot to process lineage for any hits.

Strategic Actions

  • Engage your EDR vendor to confirm coverage for shellcode fluctuation and memory-only payload staging. If your EDR cannot scan process memory for injected shellcode in near-real-time, this is the campaign that justifies the budget conversation.
  • Review certificate hygiene: Inventory all code-signing certificates in your environment and validate that none have been used to sign unexpected binaries. If you operate a signing service, ensure it requires hardware tokens and multi-person approval.
  • Update IR playbooks to include dead-drop resolver techniques. Responders should know to look for C2 config in social media APIs, survey platforms, and protocol banners — not just hardcoded IPs and domains.

Indicators of Compromise (Hunt-Ready)

  • FTP connections to servers returning banners >200 chars or containing embedded URLs/commands
  • Signed Electron binaries in user-writable paths masquerading as Discord
  • Node.js native module crypto32.node loaded by Electron applications
  • ApplicationFrameHost.exe spawning child processes or making outbound network connections
  • Non-browser process access to Pinterest API or SurveyMonkey endpoints
  • PowerShell execution originating from FTP client processes or within FTP session context

This campaign is a textbook example of threat actors outpacing detection engineering by abusing the semantic gap between what a protocol is for and what it can technically carry. FTP banners are not on anyone's threat model — and that is exactly why this works. Defenders who close that gap first will be the ones who catch the next variant before it catches them.