# Malware Campaign Weaponizes FTP Banners to Deliver Two New RATs
Researchers have uncovered a fresh campaign leveraging FTP banners as dead drop resolvers to distribute two previously unreported remote access trojans named E4del and PINHOLE. The technique exploits a commonplace network protocol to hide malware command infrastructure within seemingly legitimate FTP server responses.
The attack chain works by embedding control instructions within FTP banner messages. When a compromised system connects to an FTP server under attacker control, the banner delivers encoded commands pointing to additional command-and-control infrastructure. This method allows threat actors to obscure their C2 network from traditional detection systems that monitor for suspicious domains or IP addresses in network traffic.
FTP remains widely used in enterprise environments for file transfers and legacy system administration. FTP banners are text strings that servers display when clients connect. Because banner content is expected to vary and generally receives minimal security scrutiny, it provides an effective hiding place for malware instructions. The technique transforms FTP from a file-transfer tool into a covert signaling channel.
E4del and PINHOLE both function as full remote access trojans. RATs enable attackers to execute arbitrary commands on infected systems, harvest credentials, exfiltrate files, and pivot deeper into networks. The arrival of two new RAT variants suggests a coordinated development effort or shared tooling across threat actor groups. Both tools can establish persistent remote sessions, allowing attackers extended access to compromised machines.
The dead drop resolver approach reduces dependency on hardcoded C2 servers. Instead of embedding direct C2 addresses in malware code, attackers use intermediary services like FTP banners to point towards active infrastructure. This separation makes takedowns more difficult. Even if researchers identify one C2 server, they must decipher the dead drop resolver to locate others. The technique also complicates reverse engineering since the malware itself contains minimal C2 information.
Threat actors previously abused legitimate services like DNS, HTTP redirects, and cloud storage for similar purposes. FTP banners represent an evolution of this strategy, targeting a protocol that many organizations have deprioritized in favor of more modern alternatives. Legacy systems and older infrastructure still depend on FTP, creating pools of potential victims who may run outdated monitoring and detection tools.
Detection requires monitoring FTP banner responses for suspicious patterns or suspicious commands embedded within them. Organizations should log all FTP connection attempts and banner exchanges, then analyze these logs for indicators of compromise. Network defenders can implement rules blocking external FTP connections or requiring encrypted alternatives like SFTP.
The campaign highlights how attackers continue adapting to exploit gaps between old and new network infrastructure. While modern enterprises migrate to cloud services and encrypted protocols, legacy systems remain operational and vulnerable. FTP's relative obscurity in contemporary security discussions means fewer teams actively monitor FTP traffic for signs of abuse.
Organizations running FTP services should disable external access where possible, enforce strong authentication on remaining FTP servers, and segment FTP traffic through firewalls. Teams should also implement network segmentation to limit the impact if an endpoint becomes compromised by E4del or PINHOLE.
The discovery underscores a persistent threat pattern. As defenders secure obvious attack vectors, threat actors exploit older, overlooked systems. FTP banners demonstrate how attackers transform mundane protocol features into command infrastructure, turning routine network operations into malware delivery mechanisms.