Researchers trace malware delivery through FTP server banners

Researchers observed threat actors using FTP server banners to deliver commands for two previously undocumented Windows remote-access trojans, E4del and PINHOLE. The reported campaign begins with a ZIP archive and LNK-based infection chain, then retrieves PowerShell scripts from FTP banner responses. SOCRadar said the technique had been weaponized since early July and remained operational in August; its analysis included indicators intended to help defenders identify infrastructure and infected machines.