Cybersecurity researchers have uncovered a novel campaign using File Transfer Protocol (FTP) server banners as covert command-and-control (C2) channels for two previously undocumented remote access trojans, tracked as E4del and PINHOLE. By embedding malicious instructions within standard FTP welcome messages, threat actors are successfully bypassing domain reputation filters, URL blocklists, and conventional deep packet inspection systems.
The technique leverages dead drop resolvers (DDRs), a method where attackers hide C2 payloads in seemingly benign network metadata. Rather than relying on traditional callback domains or encrypted web traffic, the malware parses the initial FTP banner returned by a server to retrieve operational directives. This transforms a decades-old protocol into a stealthy communication layer that blends seamlessly with routine enterprise traffic.
The campaign exploits a persistent gap in modern security architectures. As organizations prioritize cloud migration, API security, and TLS-encrypted telemetry, legacy protocols like FTP have largely fallen out of routine monitoring. Security stacks remain heavily optimized for HTTP/S, DNS, and cloud API calls, leaving unencrypted legacy traffic highly attractive to adversaries seeking low-friction C2 pathways.
Security analysts warn that signature-based defenses are ineffective against this metadata-driven approach. Defenders must pivot to behavioral analytics and protocol-level anomaly detection. Recommended countermeasures include deploying network detection and response (NDR) tools configured to parse FTP banners for abnormal lengths, non-standard encoding, or embedded URLs. Organizations should also enforce strict egress filtering to block unauthorized outbound FTP traffic from endpoints lacking a documented business requirement.
Beyond immediate detection, experts stress the need to accelerate protocol modernization. Migrating from unencrypted FTP to auditable, encrypted alternatives like SFTP or FTPS significantly reduces the attack surface. Security teams are also advised to implement behavioral baselining for protocol handshakes and update both open-source and commercial network monitoring parsers to support metadata-level heuristic analysis without disrupting legitimate file transfers.
Despite the clear technical mechanics, several critical details remain undisclosed. Researchers have not yet attributed the campaign to a specific threat actor group, nor have they identified targeted industries or geographic regions. Additionally, the security community is still working to standardize entropy thresholds and decoding routines to reliably differentiate malicious FTP banners from legitimate ones without triggering excessive false positives.
The E4del and PINHOLE campaign underscores a broader tactical shift among advanced threat groups: moving away from heavily scrutinized modern protocols toward under-defended legacy infrastructure. For network defenders, it serves as a reminder that infrastructure debt continues to present tangible risks, demanding a shift from reactive signature matching to proactive behavioral monitoring and systematic deprecation of outdated services.
網絡安全研究人員揭發一項新型攻擊活動，攻擊者利用檔案傳輸協定（FTP）伺服器的歡迎訊息（Banner）作為隱蔽的指揮與控制（C2）通道，以分發兩款此前未記錄的遠端存取木馬程式，分別追蹤為 E4del 和 PINHOLE。透過將惡意指令嵌入標準的 FTP 歡迎訊息中，威脅行為者成功繞過域名信譽過濾器、URL 封鎖清單及傳統的深層封包檢測（DPI）系統。
該技術採用「隱蔽解析器」（Dead Drop Resolvers, DDRs）手法，攻擊者將 C2 負載隱藏於看似無害的網絡元數據（metadata）中。有別於依賴傳統回呼域名或加密網絡流量，該惡意軟件會直接解析伺服器返回的初始 FTP 歡迎訊息，以提取操作指令。此舉將一項沿用數十年的舊協定轉化為隱蔽的通信層，使其能完美混入日常的企業網絡流量中。
是次攻擊活動利用了現代安全架構中長期存在的監控盲區。隨著企業將資源優先投放於雲端遷移、API 安全及 TLS 加密遙測數據，FTP 等舊協定已逐漸脫離常規監控範圍。現有的安全防護架構仍高度針對 HTTP/S、DNS 及雲端 API 呼叫進行優化，導致未加密的舊協定流量成為攻擊者建立低阻力 C2 通道的理想目標。
安全分析師警告，傳統基於特徵碼（signature-based）的防禦機制對此類元數據驅動的手法成效不彰。網絡防禦人員必須轉向行為分析與協定層異常檢測。建議的應對措施包括部署網絡偵測與回應（NDR）工具，並設定其解析 FTP 歡迎訊息，以偵測異常長度、非標準編碼或內嵌 URL。企業亦應實施嚴格的出口過濾政策，攔截所有缺乏明確業務記錄的端點所發出的未經授權出站 FTP 流量。
除即時偵測外，專家強調必須加快協定現代化進程。將未加密的 FTP 遷移至具備審計功能且加密的替代方案（如 SFTP 或 FTPS），可大幅收窄攻擊面。安全團隊亦應為協定握手程序建立行為基線，並更新 open source 及商業網絡監控解析器，使其支援元數據層級的啟發式分析，同時確保不影響合法的文件傳輸作業。
儘管相關技術機制已相當明確，但仍有數項關鍵細節尚未公開。研究人員目前仍未將此活動歸因於任何特定威脅組織，亦未確認受攻擊的行業或地理區域。此外，網絡安全業界正致力制定標準化的熵值閾限與解碼程序，以便在避免產生大量誤報的前提下，準確區分惡意與合法的 FTP 歡迎訊息。
E4del 與 PINHOLE 攻擊活動突顯了進階威脅組織的一項廣泛戰術轉變：由受嚴格監控的現代協定，轉向防禦相對薄弱的舊有基礎設施。對網絡防禦人員而言，此事件再次印證「基礎設施技術債」仍構成實質風險，業界必須由被動的特徵碼比對，轉向主動的行為監控，並有系統地逐步停用過時的網絡服務。