FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

This SOCRadar investigation documents active abuse of FTP service banners as Dead Drop Resolvers used to deliver and configure malware, and details two novel RAT families—E4del (an Electron-based implant masquerading as Discord) and PINHOLE (a multi-stage native RAT using Pinterest and SurveyMonkey as DDRs and Cloudflare Workers for proxying)—including their delivery chains, evasion techniques, persistence, C2 protocols, and observable infrastructure indicators.