Cybersecurity researchers have uncovered a novel campaign where threat actors utilize FTP server banners as dead drop resolvers to facilitate the initial delivery of malicious commands. This tactical shift marks a departure from conventional reliance on web-based command-and-control infrastructures that typically use HTTPS or social media for hosting configuration data. By embedding instructions directly into the “welcome” message of an FTP server, attackers bypass many standard network security filters that are primarily configured to scan the payload of a connection rather than the protocol handshakes themselves. This method relies on the specific behavior of the File Transfer Protocol, where the server presents a banner immediately upon connection, long before any authentication occurs. As a result, the malware only needs to initiate a basic handshake to receive its next set of instructions, reducing its exposure to intrusion detection systems that monitor for active file downloads or large data bursts.
Protocol Exploitation: The Mechanics of FTP Banners
The effectiveness of using an FTP banner as a Dead Drop Resolver lies in its deceptive simplicity and the inherent trust placed in low-level protocol responses. When a compromised machine initiates a connection to a malicious FTP server, the server responds with a standard 220 code followed by a text string. In this campaign, that string contains the encoded location of the secondary payload or a specific command for the malware stager to execute. Because this interaction happens at the very beginning of the session, it does not trigger the same alerts that a traditional file transfer would. Security analysts often prioritize the inspection of the actual data exchanged within a session rather than the banner presented by the server. By hiding the command in plain sight within the protocol’s greeting, the threat actors ensure that the delivery mechanism remains functional even in environments with strict filtering. This use of a legacy protocol demonstrates the continuous adaptation of cybercriminals today.
Furthermore, the rarity of this technique presents a significant challenge for automated traffic analysis and threat hunting operations. Most modern firewall and Deep Packet Inspection solutions are optimized to detect malicious patterns in HTTP headers or SSL certificates, but they rarely scrutinize the specific text content of an FTP 220 banner. Attackers exploit this blind spot by rotating through various FTP servers, each presenting unique banners that appear to be routine system messages to the untrained eye or the unconfigured filter. This methodology complicates the attribution process and the creation of reliable signatures for detection. The transition to protocol-level manipulation indicates a broader trend toward more stealthy communication channels that do not rely on the integrity of domain names or IP reputation alone. By leveraging the handshake as a carrier for commands, the campaign achieves a high level of resilience, forcing security teams to re-evaluate monitoring for non-web protocols that have long been considered relatively low risk.
E4del and PINHOLE: Sophisticated Delivery and Technical Evasion
The E4del RAT specifically utilizes these FTP banners to initiate a complex infection chain that heavily relies on social engineering and legitimate system utilities. The primary infection vector involves the distribution of Spanish-language documents, often masquerading as invoices or legal notices, which entice the user to interact with a malicious Windows shortcut file. Once the user executes the file, the malware makes its first connection to the predefined FTP server to scrape the banner for its next instructions. These instructions usually point the victim’s machine toward a WebDAV server, where the Windows utility rundll32.exe is used to load and execute a remote library. To maintain a facade of legitimacy and avoid raising suspicion from the user, the final payload is frequently packaged as a Node.js application within a digitally signed Electron executable. This specific choice of packaging allows the malware to appear as a common application like Discord, hiding its malicious activities effectively.
In contrast to E4del, the PINHOLE RAT demonstrates a much higher level of technical sophistication, employing a multi-layered defense strategy to protect its core functionality. While it also uses unconventional resolvers, PINHOLE leverages high-reputation web platforms such as Pinterest and SurveyMonkey to host its configuration data, making it even harder to block at the perimeter. To further obscure its origin and prevent the discovery of its backend infrastructure, the malware proxies its traffic through Cloudflare Workers, providing a legitimate facade for malicious communication. Once the initial stager is running, it undergoes a rigorous six-layered unpacking process, designed to thwart static analysis and exhaust the resources of automated sandboxes. This complex architecture ensures that the final, most dangerous components of the RAT are never exposed to the disk in an unencrypted state, making it extremely difficult for traditional antivirus products to flag the malicious code before execution.
To bypass advanced detection systems, PINHOLE utilizes a sophisticated technique known as Halo’s Gate. This method allows the malware to perform direct system calls to the Windows kernel, bypassing the standard API hooks that security software uses to monitor for suspicious activity. By manually resolving the necessary system call numbers and executing them directly, PINHOLE renders many behavioral monitoring tools ineffective, as they never see the calls happening through the monitored libraries. Additionally, the malware employs Early Bird APC Injection to secure its persistence. This involves injecting its malicious shellcode into a legitimate Windows process while it is still in a suspended state, immediately after its creation. This allows the malware to begin its recursive file searches and module downloads before security agents scan the process memory. This proactive approach to evasion demonstrates a high degree of skill, targeting the specific weaknesses of modern defensive technologies.
Strategic Response: Actions Taken Against the Campaign
Organizations responded to the emergence of the E4del and PINHOLE RATs by reassessing their internal security architectures and focusing on protocol-level integrity. Security teams implemented more rigorous monitoring of port 21 and other legacy channels, specifically looking for anomalous text strings within server banners that deviated from known software versions. Advanced threat hunting teams shifted their focus toward identifying the use of rundll32.exe in conjunction with WebDAV connections, as these became key indicators of the E4del infection chain. Furthermore, the adoption of specialized tools capable of detecting direct system calls and unhooked APIs helped to mitigate the risk posed by PINHOLE’s evasion tactics. By integrating these new detection capabilities into their existing security operations centers, companies were able to close the visibility gap that the threat actors had so effectively exploited during the initial stages of the campaign.
The successful mitigation of these threats highlighted the importance of moving beyond simple signature-based detection toward a more holistic view of network behavior. Stakeholders recognized that even the most routine protocol handshakes could be weaponized, leading to a broader implementation of Zero Trust principles across all communication layers. Rather than assuming that initial protocol greetings were benign, security protocols were updated to treat every byte of data as potentially malicious until verified. This transition included the use of automated analysis tools that could parse protocol banners at scale and flag suspicious commands before they reached the endpoint. As the threat landscape continued to evolve, the lessons learned from the E4del and PINHOLE campaigns served as a blueprint for defending against future “living off the protocol” attacks. By maintaining high vigilance, organizations established a more resilient posture for the upcoming years.
