Affected Systems
Organizations globally; no specific vendor or product vulnerability. Attack targets Windows systems via social engineering (Spanish-language vouchers, ClickFix lures). Delivers E4del (Node.js/Electron-based RAT) and PINHOLE (native x86-64 RAT with advanced evasion).
Exploitation Status
Active campaign observed in the wild since July 2026. First documented use of FTP banners as dead drop resolvers. PINHOLE uses Pinterest, SurveyMonkey, and Cloudflare Workers for C2 resolution. Threat actors maintain active FTP Stats Panel to monitor campaign success.
Business Impact
Both RATs provide full remote access capabilities including reverse shell, file exfiltration, screenshot capture, desktop streaming, and payload delivery. PINHOLE employs Halo's Gate syscall evasion and Early Bird APC injection to bypass EDR/AV. E4del uses dynamic beaconing with tiered jitter (Active/Semi-Active/Inactive states) to blend with normal traffic. FTP connections to unknown servers may trigger alerts but initial compromise relies on user execution of LNK files. PINHOLE includes browser stealer module. No CVE assigned as this is a campaign, not a product vulnerability.
Urgency
🟠Within 24 hours
Recommended Actions
- Block outbound FTP connections (port 21) to the following IPs at perimeter firewalls: 157.254.194.31, 167.148.41.164, 209.99.185.38, and 69.48.228.126:5000
- Monitor for suspicious LNK file execution followed by FTP connections, WebDAV traffic, or rundll32.exe launching DLLs from non-standard paths (e.g., %TEMP%)
- Hunt for Electron applications masquerading as Discord with embedded Node.js payloads, and processes using MSXML2.XMLHTTP COM object in PowerShell to retrieve .cmd files
- Review DNS/HTTP logs for connections to cloudflare.milicare[.]in and unexpected traffic to Pinterest or SurveyMonkey followed by Cloudflare Workers requests
- Deploy behavioral detection for Early Bird APC injection patterns and processes exhibiting tiered beaconing intervals (sub-second to 9-second C2 check-ins)