E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands
Researchers identified two new RATs, E4del and PINHOLE, using FTP banners as dead drop resolvers to fetch C2 commands via ClickFix-style lures.
SOCRADAR documented two previously unreported RATs, E4del and PINHOLE, that use FTP banners as dead drop resolvers, a first in-the-wild use of this technique. E4del is a Node.js-based RAT hidden in a digitally signed Electron application masquerading as Discord, with tiered-jitter beaconing, reverse shell, screenshot capture and desktop streaming. PINHOLE is more advanced, using Pinterest, SurveyMonkey and Cloudflare Workers for C2 resolution, six layers of unpacking, Halo's Gate EDR evasion and Early Bird APC injection. A related WebDAV delivery chain overlaps with ClearFake campaigns distributing WordlistLoader and Amatera Stealer.
- First observed in-the-wild use of FTP banners as dead drop resolvers
- E4del: Node.js RAT in signed Electron app posing as Discord, adaptive beaconing
- PINHOLE: 14 commands, Early Bird APC injection, planned browser stealer module
- Operators maintain an FTP Stats Panel to monitor campaign success rates
- ATT&CK
- T1102.001 Dead Drop ResolverT1059.001 PowerShellT1218.011 Rundll32T1055.004 Asynchronous Procedure CallT1036.005 Match Legitimate Name or Location
- Vendors
- SOCRADAR
- Organizations
- MalwareHunterTeamKPMG
From the original article
4 min read at thehackernews.com
Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers ( DDRs ) to deliver two previously unreported remote access trojans (RATs) tracked as E4del and PINHOLE .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.