DEV Community

Anoymask
Anoymask

Posted on

E4del / PINHOLE Using FTP Banners for Command Retrieval

#security #threatintel

1. Basic Information

2. Executive Summary

Attackers embed PowerShell commands into the greeting messages (banners) returned by FTP servers before login, and deliver two types of RATs via LNK files.

3. Attack Flow

1. Common Entry

  1. The user opens an LNK file inside a ZIP archive.
  2. The LNK file connects to an FTP server and gets PowerShell commands from the pre-login greeting message (banner).
  3. The retrieved commands start the delivery chain for E4del or PINHOLE.

2. E4del

  1. A signed Electron app runs and looks like Discord.
  2. A Node.js RAT provides persistent/temporary shells, screen capture, WebSocket live streaming, and extra file execution.
  3. crypto32.node is described as a privilege escalation feature, but researchers could not recover it to confirm actual behavior.

3. PINHOLE

  1. A multi-stage loader resolves encrypted C2 settings from Pinterest and SurveyMonkey.
  2. It connects to the C2 via Cloudflare Workers to get the next stage.
  3. It starts ApplicationFrameHost.exe in a suspended state and injects the final RAT using Early Bird APC.
  4. It performs file operations, command execution, screen capture, and browser credential theft.

4. Attacker Infrastructure and Execution Locations

  • Uses FTP server banners as dead drop storage.
  • Relays PINHOLE C2 traffic through Cloudflare Workers.
  • Abuses Pinterest and SurveyMonkey to store C2 location info.
  • Disguises malware as legitimate Electron / ApplicationFrameHost.exe on infected Windows devices.

5. Visibility for Victims and Administrators

Victims

  • Little action is needed other than opening the shortcut inside the ZIP.
  • E4del may look like Discord, and PINHOLE may look like an update tool.

Administrators / SOCs

  • Observe unknown FTP connections without authentication, followed immediately by PowerShell.
  • See APC injection into ApplicationFrameHost.exe, Cloudflare Workers traffic, and Alternate Data Stream (ADS) settings storage.

6. Success and Failure Conditions

Success Conditions

  • The user opens the LNK file.
  • The device allows network traffic to unknown FTP servers.
  • PowerShell and multi-stage payload execution are not blocked.
  • Traffic to legitimate web services and Cloudflare Workers is allowed.

Failure Conditions

  • Block ZIP and LNK files at the email and web gateways.
  • Block outbound FTP traffic that is not needed for business.
  • Detect and block LNK-initiated PowerShell and process injection.
  • Correlate abnormal traffic from Pinterest and SurveyMonkey to Cloudflare Workers.

7. What Happens on Success

  • Remote shell and arbitrary command execution
  • Screen capture and live streaming
  • File sending and receiving
  • Theft of browser-saved credentials
  • Additional payload execution

8. Observable Logs

Email

  • ZIP/LNK attachments or download URLs
  • Initial intrusion is likely phishing, but not confirmed

Proxy / SWG / DNS

  • FTP connections to unknown IPs
  • Continuous traffic to Pinterest, SurveyMonkey, workers.dev, and nokierojotiarmx.com

Endpoint / EDR

  • LNK → PowerShell
  • Electron / Node.js disguised as Discord
  • Suspension and startup of ApplicationFrameHost.exe with APC injection
  • %TEMP%\calc.exe, ADS, and HKCU Load persistence

Identity / IdP

  • No direct IdP abuse mentioned in the article
  • PINHOLE steals browser-saved credentials

SaaS / Cloud

  • Pinterest pins and SurveyMonkey questions used for C2 resolution
  • Cloudflare Workers used as a C2 proxy

Network

  • Long text and PowerShell commands in FTP 220 banners
  • HTTP traffic to /api/health, /api/client, /api/tsk, /api/fls, etc.

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): ZIP/LNK delivered only, no file opened and no FTP connection.
  • User Action Confirmed: Opening the LNK file or the first connection to an unknown FTP server is confirmed.
  • Initial Execution Confirmed: PowerShell and loader execution confirmed after retrieving the FTP banner.
  • Malware Execution or Auth Success Confirmed: E4del/PINHOLE C2 registration and task retrieval confirmed.
  • Data Theft or Session Compromise Confirmed: Transmission of browser credentials, screens, files, and command results confirmed.

10. Investigation Playbook

Trigger

  • LNK-initiated FTP connection and PowerShell
  • Listed IOCs or ApplicationFrameHost.exe injection

Initial Check

  • Identify the source of the ZIP/LNK and the execution user
  • Preserve the 220 banner if FTP PCAP is available

Endpoint

  • Investigate Electron/Node.js, calc.exe, ADS, and HKCU Load
  • Preserve the injector process and memory

Authentication / Cloud

  • Change browser-saved credentials
  • Check access to Pinterest, SurveyMonkey, and Cloudflare

Subsequent Activity

  • Check for RAT commands, file transfers, and additional payloads
  • Search across endpoints for connections to the same FTP destination

Containment

  • Isolate the endpoint, block FTP and C2, change credentials
  • Consider rebuilding after removing persistence and extra files

Assessment Levels

  • Contact only
  • LNK execution
  • Loader execution
  • RAT C2 established
  • Data theft confirmed

11. Defense and Detection Ideas

Single Event

  • Connection from a business device to an unknown FTP server
  • PowerShell as a child of an LNK file
  • APC injection into ApplicationFrameHost.exe

Timeline Correlation

  • LNK → FTP 220 response → PowerShell → Electron or calc.exe
  • Pinterest / SurveyMonkey → workers.dev → C2 API

Threat Hunting Perspective

  • PowerShell strings in FTP banners
  • ADS in desktop.ini and HKCU Windows Load
  • Listed hashes, paths, and domains

Log Gaps

  • Network logs that keep the FTP banner body
  • Process injection telemetry
  • Visibility into content within legitimate web services

Priority Countermeasures

  • Control LNK and ZIP files
  • Block outbound FTP not required for business
  • Detect scripts and APC injection

12. Facts / Inference / Hypothesis

Facts

  • SOCRadar confirmed activity using FTP banners as Dead Drop Resolvers starting in early July 2026.
  • E4del and PINHOLE are novel RATs delivered through separate paths.
  • PINHOLE gets C2 info from Pinterest and SurveyMonkey and relays it through Cloudflare Workers.
  • PINHOLE script execution records were 11 at the time of analysis.

Inference

  • Unknown FTP connections stand out more than typical web-based DDRs, making them relatively easy to detect if outbound logs exist.

Hypothesis

  • The same FTP banner method can be reused for ClickFix, but the LNK path was the only one actually observed in the article.

13. MITRE ATT&CK Mapping

  • T1566.001 Phishing: Spearphishing Attachment (Confidence: Medium)
  • T1204.002 User Execution: Malicious File (Confidence: High)
  • T1102.003 Web Service: One-Way Communication (Confidence: Medium)
  • T1055.004 Process Injection: Asynchronous Procedure Call (Confidence: High)
  • T1059.001 PowerShell (Confidence: High)
  • T1555.003 Credentials from Web Browsers (Confidence: High)

14. Unknowns and Additional Investigation

  • Full content of the initial delivery email
  • Attacker attribution and ultimate objective
  • Actual privilege escalation capability of E4del crypto32.node

15. Impact on SOCs and Organizations

In organizations where FTP is not normally used, the combination of outbound FTP and LNK-initiated PowerShell serves as a strong detection rule. Security teams should analyze contextual relationships and process behavior rather than blocking legitimate web services entirely.

16. Summary by Target Audience

For SOCs

Monitor the chain of FTP banner content, LNK to PowerShell, and Pinterest/SurveyMonkey to Workers.

For Administrators

Block unnecessary FTP traffic, and control LNK files, scripts, and process injection.

For Users

Do not open shortcuts inside ZIP files, and check with the sender through another channel.

Top comments (0)