E4del and PINHOLE RATs Hide C2 Commands in FTP Banners

Introduction

The modern threat landscape keeps evolving, and attackers are constantly finding new ways to weaponize the tools we use every day. A recent discovery by cybersecurity researchers has revealed a disturbing new campaign in which two previously unknown remote access trojans, known as E4del and PINHOLE, are being controlled through instructions hidden in plain FTP server banners. This technique, known as dead drop resolving, allows cybercriminals to issue commands to infected machines without relying on suspicious domains, dedicated servers, or obvious communication channels.

At first glance, FTP banners look harmless. They are simple text messages that servers display when a client connects, often containing welcome notes or software version details. But in this campaign, threat actors have turned these mundane strings into covert command channels, embedding directions that infected endpoints periodically fetch and interpret. The result is a stealthy operation that blends effortlessly into regular network activity, making it extremely difficult to detect using conventional security tools.

What Are Dead Drop Resolvers and Why They Matter

Dead drop resolvers, often abbreviated as DDRs, are a clever technique in which attackers store pieces of information on publicly accessible services and have their malware periodically retrieve and decode them. Instead of hardcoding a command-and-control server address inside the malware, the malicious software knows exactly where to look for instructions, often in places nobody would think to monitor.

This method has become increasingly popular among advanced threat actors because it introduces a powerful layer of indirection. The actual command-and-control infrastructure can change at any time. The attackers simply update the content of the public location, and the malware adapts accordingly. This makes takedown efforts far more complicated and gives operators remarkable operational flexibility.

In the case of the E4del and PINHOLE campaign, the chosen dead drop locations are FTP server banners. These banners are part of standard FTP protocol behavior and are typically ignored by both users and security systems. By hiding instructions in this overlooked space, the attackers have essentially built a covert communication channel that hides in plain sight.

Inside the E4del Remote Access Trojan

E4del is one of the two newly identified remote access trojans at the center of this campaign. It is designed to give attackers persistent access to compromised systems, allowing them to execute commands, exfiltrate data, and maintain long-term footholds inside targeted environments.

What makes E4del particularly interesting is its reliance on FTP banners for command retrieval. Rather than connecting directly to a known malicious server, the malware scans FTP banners, looking for encoded instructions. These instructions can direct the trojan to download additional payloads, update its configuration, or perform specific actions on the infected host.

Key capabilities observed in E4del include:

• Stealthy communication through legitimate-looking FTP traffic
• Dynamic command updates without changing hardcoded infrastructure
• Modular design that allows attackers to add new functions on the fly
• Persistent presence that survives reboots and basic cleanup attempts

Because E4del blends its activity with ordinary FTP communications, it poses a serious challenge to traditional network monitoring tools that rely on signature-based detection or known-bad indicators.

PINHOLE RAT and the Art of Stealth

PINHOLE is the second trojan uncovered in this campaign, and it appears to complement E4del in several ways. While E4del focuses on command execution and persistence, PINHOLE seems geared toward intelligence gathering and maintaining a low profile on infected systems.

Like its counterpart, PINHOLE uses FTP banners as a dead drop mechanism. However, researchers have noted that PINHOLE appears to take additional steps to avoid detection. It minimizes its footprint on disk, uses encrypted communication where possible, and carefully times its activity to avoid raising suspicion.

Some of the distinguishing traits of PINHOLE include:

• Lightweight design that reduces the chance of triggering endpoint alerts
• Data exfiltration routines that piggyback on normal traffic patterns
• Capability to operate alongside E4del in coordinated intrusions
• Use of encoded banner content to receive updates and instructions

Together, E4del and PINHOLE form a dangerous duo. One handles direct interaction with the compromised system, while the other focuses on stealth and data collection. This division of labor suggests a well-organized operation with a clear understanding of how modern defenses work.

Why FTP Banners Make the Perfect Hiding Place

FTP banners are an ideal hiding spot for malicious instructions for several reasons. First, they are a normal part of how FTP works. Every server sends one when a connection is made, so their presence on a network is completely unremarkable. Security teams rarely inspect banner content unless they are specifically troubleshooting a connection issue.

Second, FTP banners are publicly accessible in many cases. Misconfigured servers, anonymous FTP setups, and even legitimate public file repositories all serve banners that anyone can read. This gives attackers a wide selection of locations to choose from, and the ability to swap them out whenever one becomes compromised or unavailable.

Third, banner content is rarely logged or monitored. Most organizations focus their logging efforts on authentication events, file transfers, and error messages. The text that appears in a banner is generally considered informational noise, which makes it a perfect place to stash encoded commands.

Finally, this technique complicates attribution and takedown efforts. Even if a security team discovers that a banner is being used maliciously, the actual command-and-control server behind it can be anywhere in the world and can change at any moment.

The Broader Trend of Living Off Trusted Services

The E4del and PINHOLE campaign is part of a growing trend in which attackers abuse legitimate, trusted services to support their operations. This approach, often called living off trusted services, has become a hallmark of sophisticated threat actors who understand that blending in is far more effective than standing out.

In recent years, researchers have documented similar abuses involving platforms like Google Docs, Pastebin, GitHub, and even social media networks. Each of these services offers attackers a convenient way to host or relay malicious content without raising immediate red flags. The FTP banner technique is simply the latest evolution of this idea, applied in a context that few defenders have considered.

This trend highlights an important reality for modern cybersecurity teams. Defenders cannot afford to focus only on obviously suspicious traffic. Every protocol, every service, and every seemingly mundane feature has the potential to be repurposed by a skilled adversary. A truly effective defense requires a deep understanding of how normal systems work, and how they can be twisted into tools for harm.

How Organizations Can Defend Against This Threat

Defending against techniques that abuse legitimate services requires a multi-layered approach. No single tool or policy will completely eliminate the risk, but combining several strategies can dramatically reduce exposure and improve detection capabilities.

Here are some practical steps organizations can take:

• Monitor FTP traffic carefully. If your organization does not actively use FTP, consider blocking it entirely at the network perimeter. If FTP is required, log and inspect banner content for unusual patterns.
• Audit public-facing services. Make sure FTP servers and other public services are properly configured and that banners do not contain sensitive or unexpected information.
• Deploy behavioral detection tools. Use advanced endpoint and network monitoring solutions that can flag unusual protocol behavior rather than relying solely on known indicators.
• Implement strict egress filtering. Limit outbound connections to only the destinations and services that are explicitly required for business operations.
• Invest in threat intelligence. Stay informed about emerging tradecraft and update detection rules as new techniques are discovered.
• Conduct regular threat hunting exercises. Proactively search your environment for signs of compromise rather than waiting for alerts to fire.

Conclusion

The discovery of the E4del and PINHOLE remote access trojans is a clear reminder that cybercriminals are always looking for new ways to stay hidden. By turning ordinary FTP banners into covert command channels, the operators behind this campaign have demonstrated a level of creativity and discipline that should concern every security professional. This is not a smash-and-grab operation. It is a carefully designed, stealthy intrusion framework built to survive in environments where defenders are watching.

As the line between legitimate network activity and malicious behavior continues to blur, organizations must rethink their detection strategies and invest in intelligence-driven defense. Understanding how attackers abuse trusted services, and building the capability to spot those abuses, is no longer optional. It is essential for survival in today's threat landscape.

At Grivyonx Cloud, we specialize in helping organizations stay ahead of these evolving threats through advanced AI automation and proactive cybersecurity solutions. Our platform is designed to surface the kind of subtle anomalies that traditional tools often miss, empowering security teams to detect and respond to sophisticated campaigns like E4del and PINHOLE before they can cause lasting damage.