ftp

MITRE ATT&CK: S0095 View on attack.mitre.org

Aliases: ftp.exe, ftp

Malware type
downloader
Operating systems
linux, windows, macos
Profile updated
2026-07-07 15:32:40

Context

ftp is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data.

Detection coverage

  • 82 Sigma rules

Malware & tools used

  • Lateral Tool Transfer (attack-pattern)
  • Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)

Used by threat actors

  • Quad7 Activity (campaign)
  • HomeLand Justice (campaign)
  • Naikon (threat-actor)
  • APT33 (threat-actor)
  • APT39 (threat-actor)
  • OilRig (threat-actor)
  • APT41 (threat-actor)

Reports & references

  • MITRE ATT&CK — S0095 (report)
  • Microsoft — Ftp (report)
  • linux.die.net — Ftp (report)

External references