FTP welcome banners are the new dead drop, and that suits whoever reads netflow

The tell here is the protocol, not the payload. SOCRadar's own write-up undercuts the technique it documents: pulling commands from an FTP greeting is less stealthy than the web-based dead drop resolvers it substitutes for, because security controls are likely to treat an FTP connection to an unknown server as anomalous ^[7]. In an estate that does no legitimate FTP, that is one query against flow records, and the report names three control-plane hosts to seed the list ^[18].

So the choice reads as cost rather than craft. A banner is a text field on a box the operator already runs. The alternative sits in the second family: PINHOLE keeps its C2 details on Pinterest and SurveyMonkey and proxies the traffic through Cloudflare Workers ^[14], which buys reputation at the price of depending on somebody else's abuse desk.

Two details deserve more attention than the banner itself. E4del arrives as a Node.js RAT embedded in a digitally signed Electron application dressed up as Discord ^[11], which means the signature is carrying weight that the delivery chain never tries to earn. And the beaconing is tiered rather than fixed: inside the first 20 seconds of receiving a task it checks in every 200 milliseconds to 2 seconds, drops to 2 to 5 seconds after 20 to 40 idle seconds, and settles at 5 to 9 seconds past 40 ^[13]. At the fast end that is roughly 300 check-ins a minute against about 7 to 12 in the quiet state, a swing of some 25 to 45 times ^[17]. Periodicity heuristics tuned to a single sleep value will not see a consistent rhythm to lock onto, which pushes detection back onto the FTP leg and the WebDAV fetch.

That fetch is not new either. The same WebDAV-to-rundll32 pattern has been reported in a ClearFake campaign delivering WordlistLoader and Amatera Stealer behind ClickFix lures, per Microsoft and Gen Threat Labs ^[9]. The novelty is confined to where the address comes from.

PINHOLE's loader is the more serious engineering. Its banner at 209.99.185[.]38:21 held PowerShell that used the MSXML2.XMLHTTP COM object to pull a script, wrote it to %TEMP%u.cmd, ran it, then deleted it ^[15]. The wrapper presents itself as an update utility from Weston Computing Systems Ltd, a company that does not exist, and uses Halo's Gate to get past security software ^[3]. Six unpacking layers and an Early Bird APC injection into a suspended legitimate process protect a 119 KB x86-64 executable ^[4]. All of that scaffolding guards a payload smaller than a phone photo.

One caveat on the sourcing. The two reports supplied here are the same article from the same publisher, so every technical detail traces back to a single vendor report ^[16]. The only other party credited with seeing the method is MalwareHunterTeam, which flagged it early last month ^[6]. Treat the indicators as a hunting hypothesis rather than a confirmed inventory until a second party publishes on the same hosts.