Cybersecurity researchers have uncovered a novel technique in which threat actors manipulate FTP server greeting banners to deliver malicious commands to compromised Windows systems. The operation relies on using these network banners as dead-drop resolvers to secretly pass instructions and deploy newly discovered remote access trojans.

First spotted in the wild by independent security researchers at MalwareHunterTeam and later analyzed in depth by security firm SOCRadar, the technique allows attackers to bypass traditional network monitoring and maintain persistence on targeted endpoints. The method hides malicious payloads within routine administrative server responses that typically pass unexamined through perimeter defenses.

New FTP Banner Exploit Method Discovered

In standard network operations, File Transfer Protocol (FTP) servers send a banner, or greeting message, whenever a client initiates a connection. These text strings usually inform connecting hosts about the software version, system rules, or server status before authentication takes place. However, threat actors have modified these public-facing responses to act as covert command channels.

By embedding encoded instructions directly inside the preliminary connection response of controlled FTP servers, attackers eliminate the need to establish a traditional command-and-control (C2) handshake. When a infected Windows endpoint connects to the designated FTP address, the local stager reads the incoming banner string, parses the hidden instructions, and executes the payload without ever logging into the account.

How E4del and PINHOLE RATs Are Delivered

The secondary payload deployment involves two previously undocumented remote access trojans dubbed E4del and PINHOLE. Both malware variants grant threat actors extensive control over compromised Windows devices, allowing for remote system manipulation, data exfiltration, and additional payload drops.

E4del is a Node.js-based remote access tool designed to mimic legitimate desktop software, including popular chat applications like Discord. Once active, E4del can take screen captures, run arbitrary shell commands, gather system hardware details, and retrieve secondary stage binaries. PINHOLE functions as a lightweight C2 agent focused on stealthy file transfer and process injection, keeping its footprint small to avoid endpoint detection software.

Attack Vector and Phishing Campaign Details

The infection vector begins with targeted phishing emails containing compressed ZIP archives. Inside the archive is a malicious Windows Shortcut (.LNK) file disguised as a standard document or invoice. When an unsuspecting user opens the LNK shortcut, a background script executes automatically, calling built-in Windows utilities to initiate an outward connection toward the threat actor's remote infrastructure.

Telemetry from threat intelligence platforms indicates that attackers have been actively leveraging search engines like FOFA to identify vulnerable or rogue FTP servers to act as relay nodes. Because the commands are embedded in the initial connection banner, network defense tools that monitor authenticated sessions often fail to flag the preliminary traffic.

Security analysts note that utilizing FTP server banners as dead-drop resolvers provides attackers with high operational resiliency. If security teams block an IP address, the operators can update the banner across a network of compromised servers or change DNS records without rebuilding the primary client payload.

Security Recommendations for Windows Systems

To defend against attacks relying on FTP server banners Windows malware delivery, cybersecurity experts recommend implementing strict network controls and script execution policies. Since the initial access vector relies on LNK files, enterprise environments should restrict shortcut execution from email attachments and untrusted locations.

Administrators are advised to apply the following defensive measures:

  • Block or monitor outbound FTP (Port 21) connections from workstations that do not require file transfer capabilities.
  • Implement strict rules on LNK file execution and monitor process creation spawned by command interpreters like Windows PowerShell or CMD.
  • Utilize intrusion detection systems (IDS) capable of inspecting early network protocol banners for unusual string patterns and base64-encoded strings.
  • Enforce endpoint security policies that prevent unknown executable execution from temporary directories or user profiles.

As cybercriminals continue to invent creative ways to hide command traffic inside standard internet protocols, security teams must expand visibility beyond post-authentication traffic and scrutinize basic protocol handshakes. Organizations that combine strict attachment filtering with outbound network monitoring remain best positioned to intercept these stealthy campaigns before full RAT deployment occurs.