The malware asks a question and reads its orders off the doormat: PowerShell in FTP banners

FTP's control channel opens with the server speaking first: a 220 line, sent before the client has offered a username ^[19][2]. SOCRadar's own response checklist makes the awkward part plain, asking analysts to preserve that 220 banner from packet capture if any exists ^[15]. Where it does not exist, the instruction that started the whole chain was never recorded anywhere. No credentials crossed the wire, no file moved, and the transfer accounting an FTP-aware proxy would keep stays empty ^[17].

The report's precondition list is honest about the shape of the environment this needs: outbound traffic to unknown FTP servers is permitted, PowerShell and multi-stage execution are not blocked, and traffic to legitimate web services and Cloudflare Workers is allowed ^[13]. Both halves of the chain get through, but they are not equally watched, and the guidance reflects that. Counting SOCRadar's detection cues and mitigations together gives eight items, and two of them mention FTP at all ^[18]. The other six point at process injection, Workers traffic, Alternate Data Stream storage, gateway filtering of ZIP and LNK, and the Pinterest-to-Workers correlation ^[11][12].

That distribution matters because of where the FTP hop sits. In the confirmation ladder SOCRadar publishes, the first connection to an unknown FTP server lands one tier below "initial execution confirmed", which is PowerShell and loader execution after the banner has been read ^[16]. Every other network indicator in the writeup, the workers.dev traffic, nokierojotiarmx.com, the /api/tsk and /api/fls paths, appears at or after C2 registration ^[10]. The unauthenticated FTP session is the only network event available before the loader runs ^[20]. It is also the one that looks least like an incident.

The second-stage tradecraft is the same idea repeated with better-reputed hosts. PINHOLE keeps its encrypted C2 settings in Pinterest pins and SurveyMonkey questions and reaches the C2 through Cloudflare Workers, which is three third-party services carrying addressing for one loader ^[7][21], before it starts ApplicationFrameHost.exe suspended and drops the final RAT in with Early Bird APC ^[8]. E4del takes the other route and simply looks like software you already trust, arriving as a signed Electron app dressed as Discord with a Node.js RAT behind it ^[5].

Two things in the report are not settled, and SOCRadar says so. The component named crypto32.node is described as privilege escalation, but researchers could not recover it to confirm what it does ^[6]. Initial delivery is described as likely phishing and explicitly unconfirmed ^[14]. The disk-side residue is more definite: %TEMP%\calc.exe, settings in an ADS, and an HKCU Load entry ^[9].

The practical asymmetry is that the host artifacts survive for responders while the network artifact does not. Browser-saved credentials, screen content, files and command output are all in the confirmed-theft tier ^[16], and the rotation work that follows is fixed regardless ^[15]. What is optional is whether anyone can say which server sent the 220 line.