Plan
active
FTP banner abuse used to deliver new Windows RATs E4del and PINHOLE
- Engineer — Learn: Novel delivery technique hiding commands inside FTP server banners is worth understanding for FTP-exposed environments, but no KEV/PoC/EPSS signals exist to force immediate action — review whether any internal FTP services expose banners to untrusted clients.
- SOC/IR — Plan: Two undocumented RATs with an unusual delivery vector warrant new detection logic; build rules to flag anomalous FTP banner content and hunt for E4del/PINHOLE behavioral patterns (process spawning from FTP client sessions) once IOCs are published.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.