Affected Systems
Windows systems targeted via phishing campaigns delivering LNK files. Two RATs deployed: E4del (Node.js/Electron-based, masquerading as Discord) and PINHOLE (memory-resident, using Pinterest/SurveyMonkey for C2). Campaign active since July 2026, infrastructure observed through August 2026.
Exploitation Status
Active campaign observed in the wild since July 2026, with new infrastructure detected as recently as August 2026. Low execution volume (11 events for PINHOLE) suggests early-stage targeted operations. No public PoC, but technique is operational and in use by threat actors.
Business Impact
Organizations face risk of credential theft, persistent remote access, and lateral movement. E4del provides full remote control including command execution, screenshot capture, and desktop streaming. PINHOLE uses evasive memory techniques and steals browser credentials. FTP connections to unknown servers may evade detection in environments where FTP traffic is not closely monitored. The use of legitimate platforms (Pinterest, SurveyMonkey) for C2 complicates blocking efforts.
Urgency
🟠Within 24 hours
Recommended Actions
- Block or alert on outbound FTP connections (port 21) to external servers not on an approved allowlist, especially from workstations and non-server endpoints.
- Hunt for LNK files delivered via ZIP archives in email attachments and web downloads; inspect LNK targets for FTP protocol handlers or suspicious PowerShell invocations.
- Monitor for unsigned or suspicious Electron applications, particularly those masquerading as Discord; review process trees for Node.js executables spawning shells or network connections.
- Inspect outbound connections to Pinterest and SurveyMonkey from non-browser processes; correlate with process injection events targeting ApplicationFrameHost.exe.
- Review SOCRadar IOCs (FTP server IPs, file hashes, C2 domains) and integrate into SIEM, EDR, and network monitoring tools for detection and blocking.