Hackers Abuse FTP Server Banners to Deliver New Windows Malware
Threat actors are using FTP server banners to hide commands that deliver two previously undocumented remote access trojans (RATs). Researchers found this technique has been in use since early July and remains operational.
Intelligence analysis by Qwen 2.5 (3B)
Hackers abuse FTP server banners for command delivery, deploying two new RATs. The approach is less stealthy than traditional web-based dead-drop resolvers but offers versatility.
Hackers tricked people into opening files, then used secret messages hidden in FTP servers to send bad software that lets them control computers.
Analysis
{"#initial-compromise":"Threat actors likely use phishing to compromise initial targets. The ZIP archive triggers an LNK-based infection chain, delivering two RATs named E4del and PINHOLE via FTP server banners.","#e4del-rat":"E4del is a Node.js-based RAT packaged inside a digitally signed Electron application masquerading as Discord. It supports various functionalities including command execution, screenshot capture, and payload delivery.","#pinhole-rat":"PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions. It leaves minimal footprint on the host by using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time."}
Key points
- Threat actors abuse FTP server banners for command delivery
- Two new RATs (E4del and PINHOLE) are being used in attacks
- The technique is less stealthy than traditional web-based dead-drop resolvers but offers versatility
By identifying and blocking known indicators of compromise, security teams can prevent these attacks from spreading further.
If attackers adapt their techniques or use more sophisticated methods, it could be harder for defenders to detect and stop the malware.
