Malware

E4del

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence2

E4del, disguised as a Discord application, is a Node.js-based RAT capable of executing commands

T1059.001PowerShellEvidence1

both retrieving a PowerShell script from FTP banners.

T1204.002Malicious FileEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

a Node.js module named crypto32.node that attempts privilege escalation

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Stealth

1 technique

T1036MasqueradingEvidence1

E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord.

Collection

2 techniques

T1113Screen CaptureEvidence2

E4del, disguised as a Discord application, is a Node.js-based RAT capable of executing commands, capturing screenshots

T1560Archive Collected DataEvidence1

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Command and Control

3 techniques

T1102Web ServiceEvidence1

an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands.

T1102.001Dead Drop ResolverEvidence1

Threat actors are employing a novel technique of hiding commands within FTP banners... involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

T1105Ingress Tool TransferEvidence2

E4del, disguised as a Discord application, is a Node.js-based RAT capable of executing commands, capturing screenshots, and downloading further payloads.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Aug 21, 2026

Attackers use FTP banners to hide new E4del and PINHOLE RATs | brief | SC Media

A previously undocumented Node.js-based remote access trojan disguised as a Discord application. It can execute commands, capture screenshots, and download additional payloads.

bleeping computerNews

Aug 21, 2026

Hackers abuse FTP server banners to deliver new Windows malware

A Node.js-based remote access trojan packaged inside a digitally signed Electron application masquerading as Discord. It can run commands through persistent or temporary shells, capture screenshots, stream the desktop over WebSockets, and download and execute additional payloads.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

E4del

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence2

E4del, disguised as a Discord application, is a Node.js-based RAT capable of executing commands

T1059.001PowerShellEvidence1

both retrieving a PowerShell script from FTP banners.

T1204.002Malicious FileEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

a Node.js module named crypto32.node that attempts privilege escalation

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Stealth

1 technique

T1036MasqueradingEvidence1

E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord.

Collection

2 techniques

T1113Screen CaptureEvidence2

E4del, disguised as a Discord application, is a Node.js-based RAT capable of executing commands, capturing screenshots

T1560Archive Collected DataEvidence1

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Command and Control

3 techniques

T1102Web ServiceEvidence1

an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands.

T1102.001Dead Drop ResolverEvidence1

Threat actors are employing a novel technique of hiding commands within FTP banners... involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

T1105Ingress Tool TransferEvidence2

E4del, disguised as a Discord application, is a Node.js-based RAT capable of executing commands, capturing screenshots, and downloading further payloads.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Aug 21, 2026

Attackers use FTP banners to hide new E4del and PINHOLE RATs | brief | SC Media

A previously undocumented Node.js-based remote access trojan disguised as a Discord application. It can execute commands, capture screenshots, and download additional payloads.

bleeping computerNews

Aug 21, 2026

Hackers abuse FTP server banners to deliver new Windows malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.