Hackers Exploit FTP Server Banners to Deliver New Windows RATs E4del and PINHOLE
What Happened – Threat actors are embedding PowerShell commands in FTP server greeting banners. When a compromised host connects, the banner returns the command, which stages the download of two previously undocumented remote‑access trojans (E4del and PINHOLE). The campaign appears to start with a phishing‑delivered LNK shortcut that triggers the FTP‑banner resolver.
Why It Matters for Compliance & Audit Readiness
- FTP banner manipulation is a classic misconfiguration/control‑gap scenario that SOC 2 Security (CC6.1) and Availability (CC7.1) controls are designed to detect and evidence.
- Continuous monitoring of service‑level configurations provides audit‑ready proof that banner content remains authorized and unchanged.
- Mapping this technique to your control framework helps demonstrate due‑diligence and a defensible audit trail for any future investigations.
Who Is Affected – Organizations that run public‑facing FTP services (e.g., software vendors, SaaS providers, managed hosting firms) across all verticals.
Recommended Actions
- Inventory all FTP servers and enforce a baseline banner policy.
- Deploy automated configuration‑drift monitoring to capture any unauthorized banner changes as immutable evidence.
- Incorporate banner‑integrity checks into your SOC 2 continuous‑compliance pipeline and retain logs for audit review.
Source: BleepingComputer
Technical Notes – The attackers use shortcut (.LNK) files to bootstrap the infection, then retrieve PowerShell scripts from FTP banners. E4del is a Node.js‑based RAT signed as a Discord client; PINHOLE pulls C2 data from Pinterest and SurveyMonkey and injects payloads via Early‑Bird APC. No CVE is involved; the technique leverages legitimate FTP banner functionality.