Introduction
Threat actors constantly search for covert channels to communicate with compromised hosts. One neglected vector is the FTP server banner – the greeting sent immediately after a TCP connection is established. By modifying this banner, adversaries can embed base64‑encoded PowerShell or other command strings that execute silently on the victim, delivering malicious payloads without the need for a conventional C2 listener. Early observations of this technique emerged in July 2026 when SOCRadar analysts noted anomalous FTP traffic, a finding later corroborated by MalwareHunterTeam. The practice leverages the inherently trusted, unauthenticated nature of FTP greetings, making it an effective disguise for initial infection.
FTP Banner Abuse Mechanics
When a client connects to an FTP server, the server responds with a multi‑line banner that typically includes a welcome message and optional server information. Attackers edit this banner to embed a payload, often encoded in base64 to avoid immediate detection. The payload is typically a one‑liner PowerShell command that downloads and executes a trojan binary. Because the banner is sent before any authentication, the malicious command runs in the context of the FTP client, which often runs with limited privileges but still sufficient to retrieve and execute the payload. The simplicity of the approach bypasses many network‑based detection mechanisms that focus on payload inspection after the connection is established.
Emerging Threat Landscape
Recent intelligence indicates that two previously undocumented remote access trojans, dubbed E4del and PINHOLE, are being delivered through this FTP banner technique. Both trojans exhibit advanced stealth features, including encrypted communications, credential harvesting, and persistent back‑door access. Their appearance marks a notable evolution in attacker tactics, as they combine classic network‑level abuse with modern post‑exploitation capabilities.
E4del – Technical Profile
E4del is a Windows‑targeted RAT developed in C# that communicates over HTTPS using domain‑fronting to hide its traffic. Upon execution, it establishes a covert channel by sending encrypted JSON messages to a dynamically generated subdomain. The trojan harvests system information, screenshots, and keyfiles, then forwards them to the command‑and‑control server. E4del also employs process hollowing to inject its code into legitimate processes, increasing stealth. Its payload is delivered as a PowerShell script encoded in the FTP banner, which decodes the script, downloads the executable from a remote server, and runs it with elevated privileges.
PINHOLE – Technical Profile
PINHOLE is a lightweight Go‑based backdoor that operates over both HTTP and DNS tunneling. It maintains persistence by creating a scheduled task that launches the binary at system startup. Once executed, PINHOLE enumerates running processes, collects network configuration data, and establishes a reverse shell through DNS queries to avoid firewall detection. The trojan’s configuration is stored encrypted within its binary, and it can receive commands to exfiltrate files, execute arbitrary commands, or download additional malware. Like E4del, PINHOLE is delivered via a base64‑encoded PowerShell payload embedded in the FTP banner.
Delivery Flow via FTP Banner
The attack chain begins with the adversary compromising an FTP server or manipulating a legitimate server’s banner file. The malicious banner contains a base64 string representing a PowerShell command such as:
powershell -nop -w hidden -encodedCommand <base64>
When a victim client connects, the FTP server sends the banner, the client’s FTP client interprets the string as part of the welcome message, and the PowerShell interpreter silently executes it. The script downloads the trojan binary (E4del or PINHOLE) from a remote host using HTTP or HTTPS, then runs it. Because the command is embedded in the banner, traditional IDS rules that look for suspicious downloads after the connection is established cannot see the initial payload.
Execution and Stealth Techniques
Both trojans employ several evasion tactics. E4del uses PowerShell’s -EncodedCommand flag to hide the script text, and it leverages Windows Script Host for secondary payload execution. PINHOLE encrypts its configuration and uses DNS TXT records to communicate, making network detection harder. Additionally, each trojan checks for sandbox environments by verifying the presence of debugging tools or virtual machine markers before fully deploying its functionality.
Mitigation and Detection Recommendations
Organizations should harden their FTP services by restricting banner modifications to administrative accounts only, and by monitoring for unexpected changes in banner files. Network sensors can be configured to flag FTP connections that contain non‑standard ASCII patterns or base64 strings within the greeting. Logging of FTP session initiation events, combined with integrity checks on banner content, helps detect compromise. For endpoint protection, enabling PowerShell script block logging and enforcing execution policies can prevent silent script execution. Finally, regular threat‑intel feeds should be ingested to flag known indicators of E4del and PINHOLE, such as their unique C2 domains and file hashes.
Conclusion
The abuse of FTP server banners to deliver E4del and PINHOLE demonstrates how attackers continue to repurpose legacy protocols for contemporary threats. By embedding PowerShell payloads directly into the FTP greeting, they achieve a stealthy initial foothold that bypasses many conventional defenses. Understanding the mechanics of this technique, coupled with targeted mitigation steps, is essential for organizations seeking to protect their environments from these newly identified remote access trojans.
