GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Matrices
  • Enterprise
  • Mobile
  • ICS
  • Tactics
  • Enterprise
  • Mobile
  • ICS
  • Techniques
  • Enterprise
  • Mobile
  • ICS
  • Defenses
  • Mitigations

This view

  • Original page
  • New address

GeezerVison is showing attack.mitre.org — ftp, Software S0095 | MITRE ATT&CK®

  1. Home
  2. Software
  3. ftp

ftp

ftp is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data.[1][2]

ID: S0095
ⓘ
Associated Software: ftp.exe
ⓘ
Type: TOOL
ⓘ
Platforms: Linux, Windows, macOS
Version: 2.2
Created: 31 May 2017
Last Modified: 04 June 2025
Version Permalink
Live Version
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1048 .003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

ftp may be used to exfiltrate data separate from the main command and control protocol.[1][2]
Enterprise T1105 Ingress Tool Transfer

ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.[1][2]
Enterprise T1570 Lateral Tool Transfer

ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.[1][2]

Groups That Use This Software

ID Name References
G0019 Naikon

[3]
G0087 APT39

[4]
G0096 APT41

[5]
G0064 APT33

[6]
G0049 OilRig

[7]
G1055 VOID MANTICORE

Campaigns

ID Name Description
C0038 HomeLand Justice

[8]
C0055 Quad7 Activity

Quad7 Activity.[9]

References

  1. Microsoft. (2021, July 21). ftp. Retrieved February 25, 2022.
  2. N/A. (n.d.). ftp(1) - Linux man page. Retrieved February 25, 2022.
  3. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  4. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
  5. Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.
  1. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
  2. Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
  3. CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.
  4. Microsoft Threat Intelligence. (2024, October 31). Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network. Retrieved June 4, 2025.
×
Core ATT&CK Objects
Matrices Tactics Techniques Sub-Techniques
Defenses
Mitigations Assets Detection Strategies Analytics Data Components
CTI
Groups Software Campaigns
Reference
Resources
Domains
Enterprise Mobile ICS
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.