Cybersecurity researchers have identified a novel malware distribution campaign that exploits FTP server banners as dead drop resolvers to deliver two previously undocumented remote access trojans named E4del and PINHOLE. The activity was observed in August 2026 and involves threat actors embedding malicious payload retrieval instructions within the text of FTP service banners, turning legitimate network services into covert communication channels for malware operations.
The technique leverages the inherent trust in FTP services, which are often allowed through network firewalls and monitored less stringently than other protocols. By modifying the banner text—typically used to display server identification or welcome messages—attackers encode commands that direct infected systems to fetch and execute the E4del and PINHOLE RATs. These trojans are designed to establish persistent access, exfiltrate data, and enable further lateral movement within compromised networks. Researchers noted that the use of FTP banners as dead drops reduces reliance on traditional command-and-control infrastructure, making detection more difficult for conventional security tools.
The campaign demonstrates a shift toward using legitimate protocols in unexpected ways to bypass security controls. Instead of relying on hardcoded domains or IP addresses for command-and-control, threat actors use the dynamic content of FTP banners to signal where malware should download next-stage payloads. This method allows them to update instructions rapidly without altering the malware binary itself. Security analysts observed that the FTP servers involved were either compromised legitimate systems or deliberately deployed by attackers, highlighting the dual use of both hijacked and attacker-controlled infrastructure. The E4del RAT focuses on information theft and system reconnaissance, while PINHOLE appears tailored for maintaining long-term access through encrypted communication channels.
Because the malicious instructions are embedded within benign-looking FTP banner text, network traffic analysis tools may not flag the activity as suspicious. The protocol itself remains legitimate, and the data exfiltration or command retrieval occurs over standard FTP ports, blending in with normal business operations. Additionally, the dead drop resolver model means that the malware does not need to communicate directly with attacker-controlled servers at predictable intervals, reducing the visibility of beaconing patterns. Researchers emphasized that this approach requires defenders to inspect application-layer content more deeply, including service banners and protocol metadata, rather than relying solely on port or IP-based blocking.
How do FTP banners function as dead drop resolvers in this attack? Attackers modify the banner text of FTP servers to include encoded instructions or URLs that malware uses to locate and download additional payloads, turning the banner into a dynamic pointer for malicious activity.
Why is this method effective against traditional security measures? It uses legitimate FTP traffic on standard ports, avoiding detection by port-based blocking or domain blacklists, and requires inspection of protocol content that many security tools do not perform by default.
What are the primary capabilities of the E4del and PINHOLE RATs? E4del is focused on gathering system information and stealing sensitive data, while PINHOLE is designed to maintain persistent, stealthy access to compromised networks for follow-on operations.