Cybersecurity researchers have identified a novel campaign utilizing FTP banners as Dead Drop Resolvers (DDRs) to distribute two previously unknown Remote Access Trojans (RATs) named E4del and PINHOLE. This marks the first recorded instance of malware stagers fetching commands directly from an FTP protocol's initial response. While less stealthy than traditional web-based DDRs, this method allows attackers to point to command-and-control (C2) infrastructure while attempting to blend in with legacy network traffic.
The delivery chain involves various sophisticated techniques, including Spanish-language LNK lures, WebDAV servers, and social engineering decoys. E4del is a Node.js-based RAT masquerading as a signed Discord application, featuring a dynamic jitter system to evade detection. PINHOLE, the more advanced variant, uses platforms like Pinterest and SurveyMonkey to obtain C2 details and employs the Halo's Gate technique along with Early Bird APC Injection to bypass security software and execute shellcode within legitimate processes.
Top comments (0)