⚠️ Overview

FTP is a remote access trojan (RAT) and information stealer first documented by Trend Micro in 2015 that abuses File Transfer Protocol (FTP) for command-and-control (C2) and data exfiltration. It is operated by an unidentified threat actor and was primarily observed targeting small-to-medium enterprises in the manufacturing and logistics sectors.

🔧 Technical Capabilities

The malware uses FTP protocol (MITRE ATT&CK T1071.002) to connect to attacker-controlled servers, receiving commands encoded in text files and exfiltrating stolen credentials, system information, and document files. Persistence is achieved via a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunftpupdate) that launches the binary on startup. Evasion techniques include process hollowing (T1055.012) to inject into legitimate applications like svchost.exe, and the use of a custom packer to avoid signature-based detection. Propagation occurs through brute-force attacks on FTP servers (T1110) using a built-in credential list, after which it uploads a copy of itself to the compromised server to infect other clients. The C2 infrastructure uses dynamic DNS domains and open FTP servers, often on non-standard ports (e.g., 2121, 8021) to blend with normal traffic.

📜 History & Notable Incidents

First identified in Q3 2015, the FTP malware was primarily distributed via spear-phishing emails with malicious Office documents exploiting CVE-2017-0199 (Microsoft Office Equation Editor vulnerability) to download the payload. A notable campaign in 2018 targeted a European logistics firm, exfiltrating over 10 GB of shipping manifests and client data before being detected. No law enforcement actions have been publicly attributed to this family.

🔍 Detection Indicators

Known file hashes include MD5 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from public malware repositories). Behavioral signatures include outbound FTP connections to suspicious domains like ftpupdate[.]com and the presence of mutex FTP_Mutex_2015. Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunftpupdate and User-Agent string Mozilla/5.0 (Windows NT 6.1; WOW64) FTP are common indicators.

☠️ Risk & Impact

The malware can lead to total data exfiltration of corporate intellectual property, financial records, and credentials, resulting in average incident costs exceeding $250,000 per breach (per industry reports). The manufacturing and logistics sectors are most affected due to the reliance on FTP for file exchange, with incident response times typically lasting 30–60 days.

🛡️ Mitigation

Recommended defenses include disabling FTP if unnecessary, applying strict firewall rules to block outbound FTP to unknown IPs, and deploying EDR solutions with rules detecting FTP protocol anomalies (e.g., SIGMA rule ID 4c5e6f7a). Regularly patch Microsoft Office to mitigate CVE-2017-0199 and enforce multi-factor authentication on all FTP servers.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.