1200KM / tool
ftp — Attack Tool
ftp is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: ftp, ftp.exe
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Naikon · G0019 · Pinned relationship source (relationship--0ead6cee-20a4-46fb-a9c1-8686a776f455)
- OilRig · G0049 · Pinned relationship source (relationship--fd518b7a-b35d-4689-89f6-525efbeee18f)
- APT33 · G0064 · Pinned relationship source (relationship--fca4685f-76c5-4089-b318-8f2ebab802d0)
- APT39 · G0087 · Pinned relationship source (relationship--d741a245-42ea-4bd4-bfb5-5687981e46b3)
- APT41 · G0096 · Pinned relationship source (relationship--fc86f198-f9d7-4b95-b26a-9cb9b922f2f1)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.