Hackers are exploiting FTP server banners to infect Windows systems with new malware. The campaign has been ongoing since early July and was still active in August. Researchers observed the emergence of new infrastructure for distributing the remote access trojans E4del and PINHOLE.
The attack method was first detected in July by MalwareHunterTeam, according to BleepingComputer. Researchers at SOCRadar subsequently searched for similar infrastructure and concluded that the technique has been in use since early July. New servers involved in the campaign were still being discovered as late as August.
Particularly striking is the way attackers transmit their instructions. To do so, they use the banner displayed by an FTP server as soon as a system connects. Such a banner is normally nothing more than a welcome message that appears before a user logs in. However, attackers hide commands within it that malware on the compromised system reads.
Infection likely begins with phishing
According to SOCRadar, the attack begins with a ZIP file containing a malicious Windows shortcut file (.LNK). Researchers suspect victims receive this file via phishing.
Once executed, the infection chain retrieves instructions from the server banner via an FTP connection. These instructions trigger a PowerShell script that ultimately installs one of two different remote access trojans.
The first, E4del, was developed using Node.js and packaged in a digitally signed Electron application that masquerades as Discord. Once active, the RAT can, among other things, execute commands, take screenshots, and stream the desktop via WebSockets. E4del can also download and launch additional malware.
The researchers also found references to a Node.js module called crypto32.node, which appears to be intended to gain elevated privileges on the system. SOCRadar was unable to obtain that module and therefore could not analyze it further.
PINHOLE retrieves configuration from elsewhere
The second malware family, PINHOLE, uses yet another method to maintain contact with its operators. The RAT retrieves information about its command-and-control infrastructure from Pinterest pins and questions in SurveyMonkey surveys. This allows attackers to adjust their infrastructure without sending new configurations directly to infected systems.
At the same time, PINHOLE attempts to minimize its memory footprint. According to SOCRadar, only a 4 KB segment of the payload is ever present in memory. Ultimately, the malware is injected into a paused ApplicationFrameHost.exe process using Early Bird APC injection.
The RAT has fourteen commands. Attackers can use these to, among other things, view, upload, and download files; manage processes; execute commands; and take screenshots. In addition, a separate module can steal browser data and stored login credentials.
During the analysis, SOCRadar counted only eleven instances of the PINHOLE script. This may indicate that this malware is still being deployed on a limited scale or that the campaign is still in its early stages.
FTP traffic can help defenders
The use of FTP banners as dead-drop resolvers differs from the services attackers typically employ for this purpose. Platforms like GitHub, YouTube, and X are attractive because malicious traffic can easily get lost among large volumes of legitimate traffic there.
FTP has less of that advantage. A connection from a workstation to an unknown external FTP server can actually attract attention more quickly in corporate networks. The new technique is therefore unusual, but according to SOCRadar, not necessarily harder to detect.
The researchers do warn, however, that the concept can easily be adapted for other attacks. For example, they believe the same method could be used in ClickFix campaigns, in which victims are tricked into executing malicious commands on their own computers through deceptive instructions.
SOCRadar has published indicators of compromise that organizations can use to search for both the infrastructure used and systems that may have been infected by E4del or PINHOLE.