FTP Banner C2 Abuse Delivers E4del and PINHOLE RATs — Detection and Hunting Guide for Windows Defenders

A newly reported campaign is abusing a component most security stacks never inspect: the FTP server welcome banner. According to reporting from BleepingComputer, threat actors are embedding hidden commands inside FTP server banners and using them as a covert delivery and tasking mechanism for two previously undocumented Windows remote access trojans, tracked as E4del and PINHOLE.

This matters for defenders because FTP is a legacy, plaintext protocol that many organizations still permit — often without inspection, often without egress filtering, and almost never with content-level monitoring of banner traffic. When a mature, well-documented protocol becomes a covert channel, your existing detections tuned for HTTP(S)-based C2 go blind.

If your environment allows outbound TCP/21 from endpoints, you should treat this as an active exposure today, not a theoretical one.

Technical Analysis

What Is Being Abused

When a client connects to an FTP server, the server responds with a banner message (FTP response code 220) before any authentication occurs. This banner is normally a human-readable greeting — a server name, version string, or legal notice. It is also, critically, arbitrary attacker-controlled text delivered before any login, TLS negotiation, or application-layer inspection typically kicks in.

The threat actors in this campaign are weaponizing that pre-authentication trust gap:

1. Stager execution on the victim host. An initial-stage component on the compromised Windows machine initiates an outbound FTP connection to an attacker-controlled server.
2. Banner as a dead-drop / tasking channel. The malicious FTP server responds with a crafted 220 banner containing encoded or obfuscated commands rather than a legitimate greeting.
3. Command parsing and payload retrieval. The stager parses the banner content, extracts embedded instructions, and uses them to download or execute follow-on payloads — in this case the E4del and PINHOLE RATs.
4. Full remote access. Once deployed, these RATs give operators persistent remote control of the host, enabling data theft, lateral movement staging, and follow-on payload delivery.

Why This Technique Is Effective

• No CVE, no exploit required. This is not a vulnerability in an FTP server product — it is abuse of intended protocol behavior. There is no patch for "attackers put text in a text field." Defense here is entirely behavioral and architectural.
• Pre-authentication delivery. Banner content is exchanged before credentials, so it bypasses controls keyed to authenticated sessions.
• Inspection blind spots. Many NGFW and proxy stacks deprioritize or ignore FTP entirely; SSL/TLS inspection policies obviously don't apply to plaintext FTP, and DLP rarely parses FTP banners.
• Legitimate-protocol camouflage. An outbound connection to port 21 looks like legacy business traffic in environments that still run FTP for file exchange with vendors or partners.

Affected Platforms

• Targets: Windows endpoints and servers (the E4del and PINHOLE payloads are Windows RATs).
• Exposure surface: Any environment permitting outbound FTP (TCP/20-21) from user workstations or servers without proxy enforcement or protocol inspection.
• Not affected by a software flaw: No specific FTP server or client product version is implicated — this is protocol abuse, not exploitation of a code defect. No CVE has been assigned to this campaign in current reporting.

Exploitation Status

This is confirmed in-the-wild activity delivering working malware families, per the public reporting. E4del and PINHOLE are newly documented, which means signature coverage across AV/EDR vendors will lag — behavioral detection and network egress control are your primary lines of defense right now. At the time of writing, neither family appears in the CISA KEV catalog (KEV tracks vulnerabilities, not malware families), so do not wait for a KEV-style deadline to act.

Detection & Response

Because the banner content itself is attacker-controlled and variable, signature-based detection on banner strings is fragile. The durable detection opportunities are:

1. FTP client execution on endpoints that have no business using FTP — ftp.exe, curl.exe with FTP URLs, or script interpreters reaching port 21.
2. Outbound TCP/21 connections from workstations or server processes that are not sanctioned FTP clients.
3. Script interpreters and LOLBins initiating FTP connections — a strong indicator of stager behavior.
4. Follow-on payload execution from user-writable directories immediately following FTP network activity.

Sigma Rules

---
title: FTP Client Execution From Non-Sanctioned Process or Script Interpreter
id: 3f8a2b14-7c51-4e96-b2d8-9a1c4e5f6a7b
status: experimental
description: Detects built-in FTP client usage or script interpreters invoking FTP, consistent with stagers retrieving commands or payloads via FTP banner/tasking channels as seen in the E4del/PINHOLE campaign.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1071/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.002
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_ftp_bin:
    Image|endswith:
      - '\ftp.exe'
  selection_ftp_args:
    CommandLine|contains:
      - 'ftp://'
      - 'ftp.exe -s:'
      - '-s ftp'
  selection_script_hosts:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
  condition: selection_ftp_bin or (selection_ftp_args and selection_script_hosts)
falsepositives:
  - Legacy administrative scripts using ftp.exe for vendor file exchange
  - Build or deployment pipelines transferring files over FTP
level: high
---
title: Outbound FTP Network Connection From Non-Sanctioned Process
id: 8c4d6e21-1a93-4f57-9b3e-2d7c8a0e5f41
status: experimental
description: Detects processes outside an approved FTP client list establishing outbound connections to TCP/21, a strong indicator of FTP-based C2 or staging as used to deliver E4del and PINHOLE RATs.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/
  - https://attack.mitre.org/techniques/T1071/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 21
    Initiated: 'true'
  filter_sanctioned_clients:
    Image|endswith:
      - '\FileZilla.exe'
      - '\WinSCP.exe'
      - '\filezilla.exe'
  condition: selection and not filter_sanctioned_clients
falsepositives:
  - Sanctioned legacy FTP clients not yet added to the allowlist
  - Vulnerability scanners probing FTP services
level: high
---
title: Executable Launch From User-Writable Path After Network Staging
id: 5b2e9f37-6d04-48c1-a7f2-1e3b9d5c8a06
status: experimental
description: Detects execution of binaries from user-writable staging locations (Temp, AppData, ProgramData) launched by script interpreters or FTP-capable clients, consistent with second-stage RAT deployment following FTP banner tasking.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\ftp.exe'
      - '\curl.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: selection_parent and selection_path
falsepositives:
  - Software installers and updaters executing from Temp directories
  - Legitimate user-space applications in AppData (Teams, OneDrive updaters)
level: medium

Tuning note: The second rule's filter_sanctioned_clients allowlist must reflect your environment. Inventory sanctioned FTP clients before deployment, or you will drown in false positives in shops that legitimately use FileZilla or WinSCP. If your organization has no legitimate FTP use — and most shouldn't in 2026 — remove the filter entirely and alert on every outbound TCP/21 connection from endpoints.

KQL Hunt — Microsoft Sentinel / Defender

// Hunt: Outbound FTP (TCP/21) connections from non-standard processes,
// correlated with follow-on process execution — E4del/PINHOLE staging pattern
let sanctionedFtpClients = dynamic(["filezilla.exe", "winscp.exe"]);
let ftpConnections =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort == 21 and ActionType == "ConnectionSuccess"
    | where not(InitiatingProcessFileName has_any (sanctionedFtpClients))
    | project ConnectionTime=TimeGenerated, DeviceName, DeviceId,
              InitiatingProcessFileName, InitiatingProcessCommandLine,
              RemoteIP, RemoteUrl, InitiatingProcessId;
ftpConnections
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
       or FolderPath has_any ("\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\")
    | project FollowOnTime=TimeGenerated, DeviceId, FollowOnProcess=FileName,
              FollowOnCommandLine=ProcessCommandLine, FollowOnPath=FolderPath,
              SHA256
) on DeviceId
| where FollowOnTime between (ConnectionTime .. ConnectionTime + 15m)
| project ConnectionTime, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, FollowOnProcess, FollowOnCommandLine, FollowOnPath, SHA256
| order by ConnectionTime desc

If you ingest firewall or syslog data into Sentinel, layer in a perimeter view — this catches hosts where EDR telemetry is absent or tampered with:

// Perimeter hunt: endpoints initiating outbound FTP through the firewall
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 21
| where CommunicationDirection == "Outbound"
| summarize ConnectionCount = count(), Destinations = make_set(DestinationIP, 25)
    by SourceIP, SourceHostName
| where ConnectionCount > 3
| order by ConnectionCount desc

A workstation making repeated outbound FTP connections to multiple distinct destinations — or to destinations with no documented business relationship — is a high-fidelity hunting lead even without endpoint telemetry.

Velociraptor VQL

-- Hunt for live FTP connections and FTP-capable process lineage on Windows endpoints
-- Targets E4del/PINHOLE staging behavior: unexpected processes holding port 21 connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)ftp(://|\s+-s|\.)'
   OR Name =~ '(?i)^ftp\.exe$'

-- Correlate: processes with active outbound connections to TCP/21
SELECT Pid, Name, Path, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE RemotePort == 21
  AND Status =~ 'ESTABLISHED'
  AND NOT Path =~ '(?i)(filezilla|winscp)'

Run the second query across your fleet as a scheduled hunt. Any established outbound FTP session from a non-sanctioned binary on a workstation warrants immediate triage — collect the process memory, the binary, and the remote IP before containment actions terminate the session.

Remediation & Hardening Script

The highest-value control for this threat is blocking outbound FTP at the host and perimeter level. Most organizations have zero legitimate need for endpoint-initiated FTP in 2026. The following PowerShell script audits for FTP exposure, blocks outbound FTP via Windows Defender Firewall, and reports recently executed FTP-capable tools:

# Requires: Run as Administrator
# Purpose: Audit and block outbound FTP (TCP 20/21) to disrupt FTP-banner C2 staging

# --- Step 1: Inventory existing FTP-related firewall rules ---
Write-Host "[*] Existing firewall rules referencing FTP:" -ForegroundColor Cyan
Get-NetFirewallRule | Where-Object {
    $_.DisplayName -match 'FTP' -or $_.DisplayName -match 'Port 21'
} | Select-Object DisplayName, Direction, Action, Enabled | Format-Table -AutoSize

# --- Step 2: Block outbound FTP control and data channels ---
$rules = @(
    @{ Name = 'SEC-Block-Outbound-FTP-Control-21'; Port = 21 },
    @{ Name = 'SEC-Block-Outbound-FTP-Data-20';     Port = 20 }
)
foreach ($r in $rules) {
    if (-not (Get-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue)) {
        New-NetFirewallRule -DisplayName $r.Name `
            -Direction Outbound -Action Block -Protocol TCP `
            -RemotePort $r.Port -Profile Any `
            -Description "Blocks outbound FTP to disrupt FTP-based C2/staging (E4del/PINHOLE campaign)" | Out-Null
        Write-Host "[+] Created rule: $($r.Name)" -ForegroundColor Green
    } else {
        Write-Host "[=] Rule already exists: $($r.Name)" -ForegroundColor Yellow
    }
}

# --- Step 3: Audit recent execution of FTP-capable LOLBins (last 14 days) ---
Write-Host "[*] Checking process creation logs for ftp.exe/curl.exe usage..." -ForegroundColor Cyan
$events = Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688; StartTime = (Get-Date).AddDays(-14) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'ftp\.exe|curl\.exe.*ftp://' } |
    Select-Object TimeCreated, Message -First 50
if ($events) {
    Write-Host "[!] FTP-capable tool execution detected — investigate:" -ForegroundColor Red
    $events | Format-List
} else {
    Write-Host "[+] No ftp.exe/curl-FTP execution found in last 14 days (requires 4688 auditing enabled)." -ForegroundColor Green
}

# --- Step 4: Verify the blocks are active ---
Get-NetFirewallRule -DisplayName 'SEC-Block-Outbound-FTP-*' |
    Select-Object DisplayName, Enabled, Action | Format-Table -AutoSize
Write-Host "[*] Done. Validate no business workflows depend on outbound FTP before enforcing fleet-wide." -ForegroundColor Cyan

Before deploying the firewall blocks fleet-wide, run Step 1 and Step 3 as an audit-only pass to identify any legacy business dependencies on outbound FTP. Where FTP dependencies exist, they are themselves a finding — migrate them to SFTP/HTTPS managed file transfer.

Remediation

There is no vendor patch for this campaign — it is protocol abuse, not a product vulnerability. Remediation is architectural and behavioral:

1. Block outbound FTP from endpoints and servers. Enforce deny rules for TCP/20-21 egress at the perimeter firewall and host firewall unless a documented, sanctioned business process requires it. FTP should have no path off a user workstation in 2026.
2. Where FTP is unavoidable, proxy and inspect it. Route sanctioned FTP through a dedicated proxy or managed file transfer gateway. Restrict destination allowlists to known partner IPs, and alert on any deviation.
3. Enable protocol-aware inspection. Ensure your NGFW/IDS signatures cover FTP command-channel anomalies — abnormally long banners, banners containing encoded blobs or executable-looking strings, and FTP sessions that complete without authentication (a banner-only exchange is a hallmark of this technique).
4. Restrict LOLBin abuse. Apply WDAC/AppLocker or EDR attack surface reduction rules to constrain ftp.exe, curl.exe, mshta.exe, and script interpreters on endpoints where they are not operationally required.
5. Hunt retroactively. Run the KQL and VQL hunts above across at least 30 days of telemetry. Because E4del and PINHOLE are newly documented, prior infections may have gone unidentified — look for the staging behavior, not the payload signatures.
6. If staging behavior is confirmed on a host: isolate the endpoint, capture memory and the stager binary before remediation, identify the FTP destination infrastructure and block it at the perimeter, and conduct a scoped compromise assessment for lateral movement — RAT deployment is rarely the end of the intrusion.
7. Update threat intel feeds. Subscribe to indicators for E4del and PINHOLE as vendors publish them, and ensure your EDR's behavioral (not just signature) engine is enabled and in block mode.

The Bottom Line

This campaign is a reminder that attackers don't need zero-days when defenders leave legacy protocols unmonitored and unrestricted. FTP banner abuse works precisely because nobody watches FTP anymore. Close the egress path, deploy the behavioral detections above, and hunt back through your telemetry — the stagers that pulled commands from those banners left network footprints whether your EDR recognized the payloads or not.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub