What SOCRadar Found
The Hacker News says SOCRadar observed two previously unreported RAT campaigns, E4del and PINHOLE, using FTP banners as dead drop resolvers. Instead of hiding the next-stage location in a web page or cloud document, the attacker stores commands inside the protocol's initial banner response.
The researchers note this is creative rather than perfectly stealthy. Outbound FTP to unknown servers should look stranger than ordinary web traffic, but many teams still are not watching for banner content to matter operationally.
How E4del Gets In
One chain described by SOCRadar starts with Spanish-language voucher lures that convince the victim to launch a Windows shortcut. That LNK fetches the next-stage command from an FTP banner, which then pulls a DLL from WebDAV and runs it via rundll32.exe using conhost.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The end state is E4del, a Node.js-based RAT embedded inside a digitally signed Electron application masquerading as Discord. The malware supports persistence, system fingerprinting, encrypted C2, reverse shell access, screenshots, live desktop streaming, file download, and additional payload delivery.
How PINHOLE Raises The Bar
PINHOLE uses another FTP banner path that drives PowerShell through the MSXML2.XMLHTTP COM object to pull a secondary script from infrastructure fronted through Cloudflare Workers. SOCRadar says the malware chain goes through six unpacking layers, uses Halo's Gate to evade security tooling, and then hands the payload to an Early Bird APC Injection routine inside a legitimate suspended process.
The final RAT supports 14 commands, including file enumeration, upload and exfiltration, process listing and termination, screenshots, PowerShell execution, and a browser-stealer module that researchers had not fully resolved at the time of writing.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What Defenders Should Hunt
- Alert on outbound FTP connections to unusual hosts, especially when they are followed by PowerShell, WebDAV,
rundll32.exe, or dropped command scripts in%TEMP%. - Check for Electron applications that claim to be familiar software such as Discord but show suspicious process trees, persistence, or encrypted outbound C2.
- Review whether your detections would catch Halo's Gate or Early Bird APC Injection tradecraft during the handoff from staging to final payload.
- Use the report to pressure-test whether your dead-drop detection logic is web-centric and blind to protocol abuse outside HTTP.
Source Context
CyberExperts used The Hacker News as the primary source and preserved the operational details worth carrying forward: FTP banners as DDRs, the voucher-lure-to-LNK-to-WebDAV E4del chain, the Node.js RAT inside a signed Electron app, the PINHOLE use of Cloudflare Workers, Halo's Gate, Early Bird APC Injection, and the attacker's FTP stats panel.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
