E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Cybersecurity researchers observed a novel campaign using FTP banners as dead drop resolvers to deliver two RAT families — E4del (Node.js/Electron-based, dynamic jittered beaconing) and PINHOLE (sophisticated loader using Cloudflare Workers, APC injection and multi-layer unpacking). The report includes delivery chains (LNK/WebDAV/PowerShell), detailed TTPs, RAT capabilities (remote shell, file exfiltration, screenshots, remote execution), and IoCs such as multiple FTP IPs, domains and a monitoring panel URL; the campaign appears technically advanced but still in early stages.