Cybersecurity experts have identified a novel tactic using FTP banners as dead drop resolvers (DDRs) to distribute two newly discovered remote access trojans (RATs), named E4del and PINHOLE. This innovative approach marks the first instance of such a technique being observed in active cyber threat campaigns.
Mechanism of FTP Banner Exploitation
FTP banners, typically used as greeting messages by FTP servers, are being manipulated to deploy malware commands. SOCRadar, a cybersecurity firm, detailed that this method involves malware stagers extracting commands from the initial FTP response. This technique, although less covert than web-based DDRs, can trigger alerts when connecting to unfamiliar FTP servers.
A particular attack sequence employs Spanish-language baits related to voucher claims to mislead users into running a Windows Shortcut (LNK). This action retrieves further commands from an FTP banner, which connects to a WebDAV server. Subsequently, a DLL is executed via “rundll32.exe” using conhost, illustrating the complexity of this method.
Detailed Examination of Attack Chains
In addition to FTP banners, attackers utilize WebDAV in campaigns like ClearFake, which Microsoft and Gen Threat Labs have reported. These operations use compromised websites to distribute malware by enticing users with fake CAPTCHA challenges. SOCRadar identified a specific FTP address, “157.254.194[.]31:21,” that initiates a multi-step delivery chain, downloading a Node.js-based RAT, E4del, disguised as a Discord application.
E4del is capable of evasion, persistence, and encrypted communication, enabling functions such as reverse shell access and live desktop streaming. The RAT operates dynamically, adjusting its activity levels based on elapsed time since its last command.
PINHOLE RAT and Advanced Techniques
The second RAT, PINHOLE, employs more sophisticated methods, using reputable platforms like Pinterest for DDRs and relaying communications via Cloudflare Workers. Commands from its FTP banner involve using MSXML2.XMLHTTP in PowerShell to execute scripts discreetly, minimizing forensic footprints.
PINHOLE also utilizes a unique injection technique, bypassing security measures through a suspended process and asynchronous procedure calls (APCs). Its functionalities include file exfiltration, process management, and PowerShell command execution, revealing its extensive capabilities.
The attackers have an “FTP Stats Panel” for monitoring campaign success, although only 11 executions suggest this is an emerging threat. This innovative use of FTP banners for malware delivery reflects a creative shift in tactics, with potential for adaptation in future campaigns.
