FTP Exfiltration

Overview

Cross-family exfiltration technique: malware uploads stolen data to an attacker-controlled FTP server. Less common than SMTP or Telegram exfiltration in modern crimeware, but still observed in older families and custom tooling.

Typical Configuration

• Hardcoded FTP server hostname/IP, username, and password
• Passive mode FTP to traverse NAT/firewalls
• Often combined with FTP client credential theft (FileZilla, CoreFTP, etc.)

Observed In

• Historically observed in older AgentTesla variants and commodity stealer builders
• Some Remcos variants support FTP as a secondary exfil channel

Related

• smtp-exfiltration — more common frictionless exfil channel
• telegram-bot-exfiltration — modern alternative with no server infrastructure
• browser-credential-harvesting — primary collection source