Malware Authors Unveil Sneaky FTP Server Exploit: A Threat Lurking in Plain Sight
Threat actors have discovered a novel way to deliver malicious code, abusing FTP server banners to evade detection and compromise Windows systems. Researchers at SOCRadar have been tracking this technique since early July 2026, warning that the approach is not only stealthy but also versatile enough to be adapted for various types of attacks.
The exploitation method relies on embedding commands in the initial response sent when a compromised system connects to an FTP server. This tactic allows malware authors to receive instructions from a remote server without raising suspicion, as the malicious activity blends in with legitimate network traffic. By using FTP banners, attackers can hide their tracks and bypass traditional detection mechanisms.
The researchers observed that the attacks start with a ZIP archive that triggers an LNK-based infection chain. The initial compromise likely occurs through phishing, where users are tricked into downloading the infected file. Once executed, the malware delivers two remote access trojans (RATs): E4del and PINHOLE. These RATs allow attackers to gain remote control over compromised systems, steal sensitive information, and even deploy additional payloads.
E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord. This RAT supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads. On the other hand, PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions, offering resilience to take-downs.
The malware leaves a minimal footprint on the host, using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time. It also injects the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers.
While abusing FTP banners to deliver commands is a novel alternative, SOCRadar warns that this approach is less stealthy than traditional web-based dead-drop resolvers (e.g., X, GitHub, YouTube). However, the technique’s versatility makes it an attractive option for attackers. The researchers note that it could easily be adapted for ClickFix social engineering campaigns.
To mitigate this threat, defenders should focus on identifying indicators of compromise and monitoring network traffic for suspicious FTP connections to unknown servers. SOCRadar’s report provides valuable insights into the malicious infrastructure and infected machines on the network.
In conclusion, malware authors continue to push the boundaries of stealthy attacks, exploiting novel techniques like abusing FTP server banners. As defenders, it is essential to stay vigilant and adapt our detection mechanisms to address these emerging threats. By doing so, we can better protect ourselves against the evolving landscape of cyberattacks.
Source: Bleeping Computer — 2026-08-21