[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuKxiczioEY09FJ6ggZk9PZaMav9bWgYqkCiEBliRgF0":3},{"article":4,"iocs":42,"watch_terms":48,"solutions":49,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"c71f5688-7b68-44df-8781-2ba69b0d15b2","Hackers abuse FTP server banners to deliver new Windows malware","hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-24de1c","Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. [...]","Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans, E4del and PINHOLE. This technique, observed since early July 2026, uses shortcut files and FTP banners as dead-drop resolvers to retrieve commands. E4del is a Node.js-based RAT disguised as Discord, while PINHOLE retrieves C2 configurations from platforms like Pinterest and SurveyMonkey.","Hackers use FTP banners to hide commands delivering new Windows malware E4del and PINHOLE.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-abuse-ftp-server-banners-to-deliver-new-windows-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F05\u002Fhacker.jpg","2026-08-21T11:00:00+00:00","2026-08-21T12:00:24.408531+00:00",8,[17,20,22],{"name":18,"type":19},"Node.js","product",{"name":21,"type":19},"Electron",{"name":23,"type":19},"Discord","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":24,"icon":26,"name":27,"slug":28},null,"Malware","malware",[30,35,37],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":36},{"id":24,"icon":26,"name":27,"slug":28},{"category":38},{"id":39,"icon":26,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43,46],{"type":28,"value":44,"context":45},"E4del","Previously undocumented remote access trojan.",{"type":28,"value":47,"context":45},"PINHOLE",[18,21,23],{"controls":50,"vendors":138},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":81,"name":82,"problem":83,"products":84},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":110,"name":111,"problem":112,"products":113},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"ftp-banner-abuse-used-to-deliver-stealthy-remote-access-trojans","FTP Banner Abuse Used to Deliver Stealthy Remote Access Trojans","Threat actors are exploiting a legitimate but rarely scrutinized FTP server feature — banner messages — as a covert channel to deliver commands and stage two novel RATs, E4del and PINHOLE. By abusing trusted platforms like Pinterest and SurveyMonkey as dead-drop resolvers for C2 configurations, attackers blend malicious traffic into normal web activity, making detection extremely difficult. E4del masquerades as Discord to evade application-layer controls, highlighting how disguised software can bypass naive allowlisting. This matters because organizations rarely monitor FTP banners for embedded commands or inspect outbound traffic to legitimate consumer web services, leaving a significant blind spot in their detection posture.",[144,145,146,147,148,149,150,151,152,153,154],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 CM-6 (Configuration Settings)","NIST SP 800-53 SI-4 (System Monitoring)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AC-17 (Remote Access)","MITRE ATT&CK T1102 (Web Service as C2)","MITRE ATT&CK T1071.002 (Application Layer Protocol: FTP)","MITRE ATT&CK T1036 (Masquerading)","ITIL – Event Management (detecting anomalous service behavior)",{}]