2026-08-22 · view entry permalink →
A malware stager is reading its next instruction out of an FTP server's pre-login greeting — and the researchers who found it point out this is the rare command channel that is easier to catch, not harder
SOCRadar's Threat Research Unit documents a delivery chain whose novelty is where the stager gets its orders. A dead-drop resolver is a legitimate service abused to hold the attacker's addresses or commands so the delivered payload never carries them itself; the channels defenders have learned to watch are code-hosting and social platforms, DNS records and blockchain transactions. Here the stager reads its next instruction from the greeting text an FTP server sends before login — the pre-authentication banner. That evades the inspection, reputation and takedown machinery built for the other channels for a simple structural reason: an FTP handshake's opening response is normally treated as connection metadata rather than as content to inspect, and it is retrieved without ever authenticating, so no credential or session artifact is produced. SOCRadar establishes the technique has been in use since early July 2026 with new infrastructure as recently as August 2026, names two previously undocumented remote-access trojans it found delivered this way, and assesses them as separate clusters sharing one delivery technique with insufficient evidence for attribution (SOCRadar, 2026-08-21).
The most useful sentence in the report is the one arguing against its own headline. SOCRadar states plainly that this method is less stealthy than traditional web-based resolvers, because security teams are more likely to flag FTP connections to unknown servers as anomalous (SOCRadar, 2026-08-21). That is worth taking at face value. The reason web-service resolvers are hard to catch is volume: an endpoint reaching a major code-hosting or video platform is indistinguishable from a million legitimate requests. An endpoint opening an FTP control connection to an arbitrary internet host, in a modern enterprise, is close to unheard of. This is a novel channel that happens to be a better detection opportunity than the one it replaces, which is not the usual direction of travel.
The signature-trust lesson in the first implant generalises well past this campaign. E4del abuses how Electron desktop applications are built: the application's own JavaScript logic does not live inside the signed executable but in a resource archive beside it. The actors ship a legitimate, digitally signed vendor executable — a widely used chat client — along with the runtime libraries it expects, and replace the contents of that resource archive with their own code. SOCRadar's description of the consequence is the point: the operating system identifies a digitally signed binary loading trusted dependencies, masking the malicious code residing in the replaced application logic (SOCRadar, 2026-08-21). No signature is broken or forged, and the process name, publisher and certificate all check out against an allowlist. Any signed application that hosts an interpreter and loads its logic from a sibling resource file inherits the same weakness. The behavioural discriminators SOCRadar surfaces are what a defender can actually use: the implant runs the host application with switches that suppress any window, so a chat client is resident with no interface ever drawn; it enumerates installed security products before beaconing; it refuses to run unless invoked with an argument matching the intended victim's username, which is an anti-analysis check and also a reason a sandbox verdict may come back clean; and it persists by registering the signed host binary as a login item rather than dropping anything new. The second implant, PINHOLE, is built for endpoint-sensor evasion — recovering syscall numbers from neighbouring unhooked functions to issue direct calls, keeping only a small slice of its payload resident in memory at a time, and injecting its final stage into a suspended standard Windows interface-host process — and holds its command-and-control configuration in ordinary consumer web platforms rather than on infrastructure that can be taken down.
two previously undocumented Remote Access Trojans (RATs), which we have named E4del and PINHOLE
this method is less stealthy than traditional web-based DDRs, as security teams are more likely to flag FTP connections to unknown servers as anomalous.
the operating system identifies a digitally signed Discord.exe loading trusted dependencies, effectively masking the malicious code residing in app_bootstrap/index.js.