For a lot of businesses, the FTP server is one of those pieces of infrastructure that’s been running quietly in the background for years. It works, nobody thinks about it, and it rarely makes it onto anyone’s list of security priorities. A new discovery from threat researchers is a good reason to change that — and to put FTP server security back on the radar for IT teams that assumed this old protocol was too low-profile to matter.
A New Twist on an Old Protocol
Security researchers at SOCRadar, building on an initial finding from MalwareHunterTeam, uncovered a campaign where attackers are hiding malicious commands inside FTP server banners — the simple greeting message a server sends to any device that connects to it, before login even happens.
Normally, that banner is harmless: a line of text identifying the server software or welcoming the connection. In this campaign, attackers are using it as what’s called a “dead-drop resolver” — a place to stash instructions that malware already running on a victim’s machine can quietly retrieve. The infected machine connects to the FTP server, reads the banner, and pulls its next set of marching orders straight out of that greeting text. It’s a clever workaround for anyone who’s tightened up FTP server security in more obvious ways but hasn’t considered banner content as an attack surface.
How the Infection Happens
Researchers report the attacks typically start with something very ordinary: a phishing email carrying a ZIP file. Inside is a shortcut (.LNK) file that kicks off the infection chain. Once triggered, the chain fetches a PowerShell script hidden inside an FTP banner, which then delivers one of two previously undocumented remote access trojans (RATs):
- E4del — a Node.js-based RAT disguised as a digitally signed Discord application. It can run commands, take screenshots, stream a live view of the victim’s desktop, and download additional malicious payloads.
- PINHOLE — a stealthier tool that gets its instructions not just from FTP banners but also from Pinterest pins and SurveyMonkey survey questions, making it harder to trace and take down. It supports 14 different commands, including file theft, process manipulation, screenshot capture, and stealing saved credentials from web browsers.
Researchers note that PINHOLE goes out of its way to stay hidden — keeping only small pieces of itself in memory at any given time and injecting its code into a legitimate, already-running Windows process rather than launching its own suspicious one.
Why FTP Server Security Matters Even If You Don’t Actively Use FTP
Here’s the uncomfortable part: this technique doesn’t require your FTP server to be misconfigured, unpatched, or even actively used by your team. The attackers aren’t breaking into the FTP server — they’re using any publicly reachable FTP service (sometimes their own infrastructure) as a place to leave instructions, and it’s the victim’s infected machine that reaches out to retrieve them.
That means the real exposure isn’t the FTP server itself — it’s whether an employee’s machine can freely make outbound connections to unfamiliar external servers on file-transfer ports without anything noticing or flagging it. For most small and mid-sized businesses, the honest answer is: probably. That gap is exactly why FTP server security needs to be reframed as an outbound-monitoring problem, not just an inbound-configuration one.
This is also a useful reminder about something bigger than this one campaign. FTP is a decades-old protocol that was never built with modern security expectations in mind — no encryption by default, minimal logging in many setups, and traffic that often gets far less scrutiny from security tools than web traffic does. Attackers are drawn to exactly that kind of blind spot.
What This Should Prompt You to Check
If your organization still runs an FTP server — whether for vendor file transfers, legacy application support, or something someone set up years ago and forgot about — this is a good moment to strengthen your FTP server security by asking a few questions:
- Do we still need FTP at all? If the answer is no, decommissioning it removes the exposure entirely. If yes, migrating to SFTP or FTPS adds encryption and stronger authentication.
- Are outbound connections being monitored? Unexpected outbound traffic to unfamiliar FTP servers — especially from workstations that have no business reason to be making those connections — is a red flag worth alerting on.
- Is anyone actually watching the logs? Legacy services are often the least monitored part of an environment, precisely because they’re assumed to be low-risk.
- Are employees trained to recognize phishing with ZIP/LNK payloads? The infection chain here starts with a very familiar delivery method, and awareness training remains one of the cheapest, highest-return defenses available.
The Bigger Picture
Attackers are constantly hunting for the parts of a network that don’t get a second glance — the old protocol, the “set it and forget it” service, the traffic nobody’s watching. FTP just happens to be this month’s example. Next month it could be something else. The pattern that matters is the same one we keep coming back to: overlooked infrastructure becomes the easiest way in, and consistent FTP server security reviews are one of the simplest ways to close that gap.
If it’s been a while since anyone reviewed what’s actually running — and what it’s actually talking to — in your environment, that review is worth doing now, before a threat actor does it for you.
Not sure what’s quietly running (or reachable) in your network? Contact Black Belt Secure to schedule a security assessment and find out.