What SOCRadar Found
The Hacker News says SOCRadar observed two previously unreported RAT campaigns, E4del and PINHOLE, using FTP banners as dead drop resolvers. Instead of hiding the next-stage location in a web page or cloud document, the attacker stores commands inside the protocol's initial banner response.
The researchers note this is creative rather than perfectly stealthy. Outbound FTP to unknown servers should look stranger than ordinary web traffic, but many teams still are not watching for banner content to matter operationally.
How E4del Gets In
One chain described by SOCRadar starts with Spanish-language voucher lures that convince the victim to launch a Windows shortcut. That LNK fetches the next-stage command from an FTP banner, which then pulls a DLL from WebDAV and runs it via rundll32.exe using conhost.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. 5 minutes or less.
Built from 100+ trusted cybersecurity sources.
The end state is E4del, a Node.js-based RAT embedded inside a digitally signed Electron application masquerading as Discord. The malware supports persistence, system fingerprinting, encrypted C2, reverse shell access, screenshots, live desktop streaming, file download, and additional payload delivery.
How PINHOLE Raises The Bar
PINHOLE uses another FTP banner path that drives PowerShell through the MSXML2.XMLHTTP COM object to pull a secondary script from infrastructure fronted through Cloudflare Workers. SOCRadar says the malware chain goes through six unpacking layers, uses Halo's Gate to evade security tooling, and then hands the payload to an Early Bird APC Injection routine inside a legitimate suspended process.
The final RAT supports 14 commands, including file enumeration, upload and exfiltration, process listing and termination, screenshots, PowerShell execution, and a browser-stealer module that researchers had not fully resolved at the time of writing.
What Defenders Should Hunt
- Alert on outbound FTP connections to unusual hosts, especially when they are followed by PowerShell, WebDAV,
rundll32.exe, or dropped command scripts in%TEMP%. - Check for Electron applications that claim to be familiar software such as Discord but show suspicious process trees, persistence, or encrypted outbound C2.
- Review whether your detections would catch Halo's Gate or Early Bird APC Injection tradecraft during the handoff from staging to final payload.
- Use the report to pressure-test whether your dead-drop detection logic is web-centric and blind to protocol abuse outside HTTP.
Source Context
CyberExperts used The Hacker News as the primary source and preserved the operational details worth carrying forward: FTP banners as DDRs, the voucher-lure-to-LNK-to-WebDAV E4del chain, the Node.js RAT inside a signed Electron app, the PINHOLE use of Cloudflare Workers, Halo's Gate, Early Bird APC Injection, and the attacker's FTP stats panel.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
