The attack begins with a malicious FTP server that responds to connection requests with a custom banner. This banner contains obfuscated commands, which are then executed on the client machine after a successful connection. The technique is notable because it blends into normal network traffic, making it harder for security tools to flag the initial stage of the infection.

Following the execution of the banner-based commands, the malware loader proceeds to install either E4del or PINHOLE. Both trojans are designed for remote access, giving the attackers control over the infected host. While the full scope of their capabilities is not detailed, the presence of these backdoors could allow for data exfiltration, lateral movement, or further payload delivery.

Key technical indicators from the campaign include:

• Malicious FTP banners acting as the initial infection vector.
• Delivery of two distinct RATs: E4del and PINHOLE.
• The malware targets Windows operating systems.
• Both trojans are described as previously undocumented, suggesting a fresh or low-signature threat.

This approach is a reminder that attackers will repurpose standard network protocols for stealth. Organizations should monitor FTP connections, especially outbound ones, for unusual banner content or unexpected connection attempts to internal hosts.

Source: BleepingComputer

Are you reviewing FTP traffic logs for anomalous banner strings, and how would your security team detect this kind of protocol-based abuse?