Malware

PINHOLE

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Execution

2 techniques

T1059.001PowerShellEvidence1

both retrieving a PowerShell script from FTP banners.

T1204.002Malicious FileEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

It employs techniques like shellcode fluctuation and APC injection into legitimate processes to minimize its footprint.

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Stealth

1 technique

T1055Process InjectionEvidence2

It employs techniques like shellcode fluctuation and APC injection into legitimate processes to minimize its footprint.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

PINHOLE supports numerous commands, including file manipulation and credential theft.

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

deploying a module for stealing credentials stored in browsers.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

PINHOLE supports 14 commands, including file enumeration

Collection

2 techniques

T1113Screen CaptureEvidence1

capturing screenshots

T1560Archive Collected DataEvidence1

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Command and Control

2 techniques

T1102Web ServiceEvidence1

an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. | PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions

T1102.001Dead Drop ResolverEvidence1

PINHOLE, a more sophisticated RAT, retrieves its command and control configuration from Pinterest pins and SurveyMonkey surveys | Threat actors are employing a novel technique of hiding commands within FTP banners... involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Aug 21, 2026

Attackers use FTP banners to hide new E4del and PINHOLE RATs | brief | SC Media

A previously undocumented remote access trojan that retrieves C2 configuration from Pinterest pins and SurveyMonkey surveys. It uses shellcode fluctuation and APC injection for stealth and supports file manipulation and credential theft.

bleeping computerNews

Aug 21, 2026

Hackers abuse FTP server banners to deliver new Windows malware

A remote access trojan that retrieves C2 configuration from Pinterest pins and SurveyMonkey survey questions. It minimizes host footprint by keeping only one 4KB payload section in memory at a time and injects the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. It supports file enumeration, file upload/download, command execution, process management, screenshot capture, and deployment of a browser credential-stealing module.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

PINHOLE

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Execution

2 techniques

T1059.001PowerShellEvidence1

both retrieving a PowerShell script from FTP banners.

T1204.002Malicious FileEvidence2

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

It employs techniques like shellcode fluctuation and APC injection into legitimate processes to minimize its footprint.

T1547.009Shortcut ModificationEvidence1

This unusual method was first observed in July by MalwareHunterTeam and involves using shortcut files and FTP server banners as dead-drop resolvers to retrieve commands

Stealth

1 technique

T1055Process InjectionEvidence2

It employs techniques like shellcode fluctuation and APC injection into legitimate processes to minimize its footprint.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

PINHOLE supports numerous commands, including file manipulation and credential theft.

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

deploying a module for stealing credentials stored in browsers.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

PINHOLE supports 14 commands, including file enumeration

Collection

2 techniques

T1113Screen CaptureEvidence1

capturing screenshots

T1560Archive Collected DataEvidence1

The attack chain begins with a ZIP archive, likely distributed via phishing, which initiates an LNK-based infection.

Command and Control

2 techniques

T1102Web ServiceEvidence1

T1102.001Dead Drop ResolverEvidence1

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Aug 21, 2026

Attackers use FTP banners to hide new E4del and PINHOLE RATs | brief | SC Media

bleeping computerNews

Aug 21, 2026

Hackers abuse FTP server banners to deliver new Windows malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.