FTP banners now double as C2 channels: meet the E4del and PINHOLE RATs
Attackers have found a new hiding place for malware staging: the greeting text an FTP server sends on connection. SOCRadar's STRU traced that dead-drop trick, first spotted by MalwareHunterTeam, to two new RATs — E4del, a Node.js Electron app masquerading as Discord, and PINHOLE, which pulls its C2 config from Pinterest and SurveyMonkey. It's a first in the wild, though arguably less stealthy than web-based resolvers.