Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1071.002: File Transfer Protocols

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as SMB[1], FTP[2], FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

EnterpriseT1071.002Sub-techniqueObject v1.4 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

File transfer protocols such as SMB, FTP, FTPS, and TFTP can be abused for command-and-control because they may already be allowed in normal business operations. The business issue is not simply that files move over the network; it is that command instructions and results can be hidden inside traffic that defenders may treat as routine, especially across Windows, Linux, macOS, ESXi, and network-device environments.

Executive priority

Prioritize this technique where file transfer protocols are broadly permitted across network boundaries or between internal segments. Leaders should ask whether the organization can distinguish approved file-transfer use from unexpected command-and-control patterns, and whether firewall, intrusion prevention, and SOC monitoring evidence can support incident decisions and compliance assertions. This is especially material for environments with critical infrastructure, manufacturing, telecom, government, education, finance, healthcare, or other sectors represented in the related ATT&CK campaign, group, and software context, but local exposure must be validated.

Technical view

This is an enterprise command-and-control sub-technique of Application Layer Protocol. SOC and detection teams should validate monitoring for SMB, FTP, FTPS, and TFTP traffic across ESXi, Linux, macOS, network devices, and Windows where those platforms exist. Because ATT&CK does not provide native detection text for this object, use the related detection strategy DET0416 as the ATT&CK-supported direction: detection of file-transfer-protocol-based C2. Focus on protocol use that is unexpected for the asset, network zone, direction, peer, timing, or volume, and on transferred files or protocol fields that may conceal command data or results.

Likely telemetry

  • Network connection metadata for SMB, FTP, FTPS, and TFTP sessions
  • Firewall, proxy, and network appliance allow/block logs for ingress, egress, and lateral traffic
  • Network intrusion detection/prevention alerts and signature matches at network boundaries
  • Protocol-aware logs or packet metadata showing client, server, ports, commands, filenames, transfer size, timing, and direction where available
  • Endpoint or server logs showing file-transfer client/server activity on Windows, Linux, macOS, ESXi, and network devices where applicable

Detection direction

  • Validate whether DET0416-style coverage exists for FTP, FTPS, SMB, and TFTP command-and-control behavior rather than only basic port monitoring.
  • Baseline legitimate file-transfer flows by business application, server role, network segment, and administrative process; tune on deviations such as unusual peers, new external destinations, abnormal timing, or unexpected lateral use.
  • Treat encryption in FTPS as a visibility constraint: teams may need metadata, endpoint context, boundary controls, or approved-use inventories rather than relying only on payload inspection.
  • Correlate network events with endpoint process and file activity to reduce false positives from legitimate backups, patching, administration, file shares, or application transfers.
  • Use relationship context to inform threat hunting for malware or tools listed by ATT&CK as using this technique, including Cobalt Strike, Regin, Machete, ShadowPad, and other related software, without assuming their presence.

Mitigation priorities

  • First, inventory where SMB, FTP, FTPS, and TFTP are legitimately required across ingress, egress, and lateral paths.
  • Apply M1037 Filter Network Traffic: restrict protocol use to authorized systems, destinations, and network zones; remove broad outbound or lateral allowances where business need is absent.
  • Apply M1031 Network Intrusion Prevention: use intrusion detection/prevention signatures at network boundaries to block or alert on known malicious or policy-violating file-transfer traffic.
  • Segment sensitive systems and administrative networks so file-transfer protocols cannot become unrestricted command channels between unrelated zones.
  • Review legacy or unauthenticated file-transfer services such as TFTP and plain FTP for business necessity, compensating monitoring, and policy enforcement.
Analyst notes and limits

ATT&CK links this technique to multiple campaigns, groups, and software families, including Operation Honeybee, Quad7 Activity, Dragonfly, SilverTerrier, Kimsuky, APT41, MirrorFace, Regin, Cobalt Strike, XAgentOSX, JPIN, Kazuar, NOKKI, Machete, ZxShell, PoetRAT, Attor, SYSCON, CARROTBALL, and ShadowPad. Use those relationships for prioritizing hunts and intelligence mapping, not as proof that any actor or tool is active in a specific environment.

The official ATT&CK detection field is not provided for this technique, and the supplied relationships do not include detailed analytics logic. This take therefore stays at validation and control-prioritization level. Local network architecture, approved file-transfer workflows, logging depth, and encrypted-traffic visibility are required to determine real coverage.

Official MITRE ATT&CK definition

File Transfer Protocols

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as SMB[1], FTP[2], FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1071 Application Layer Protocol This object subtechnique of Application Layer Protocol.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Group Enterprise

G0035: Dragonfly

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]

Group Enterprise

G1054: MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Malware Enterprise

S0428: PoetRAT

PoetRAT is a remote access trojan (RAT) that was first identified in April 2020. PoetRAT has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. PoetRAT derived its name from references in the code to poet William Shakespeare. [1][2][3]

Windows
Malware Enterprise

S1242: Qilin

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.[1][2][3][4][5]

ESXiWindowsLinux
Tool Enterprise

S0699: Mythic

Mythic is an open source, cross-platform post-exploitation/command and control platform. Mythic is designed to "plug-n-play" with various agents and communication channels.[1][2][3] Deployed Mythic C2 servers have been observed as part of potentially malicious infrastructure.[4]

WindowsLinuxmacOS
Malware Enterprise

S0019: Regin

Regin is a malware platform that has targeted victims in a range of industries, including telecom, government, and financial institutions. Some Regin timestamps date back to 2003. [1]

Windows
Malware Enterprise

S1228: PUBLOAD

PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]

Windows
Malware Enterprise

S0265: Kazuar

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. [1]

WindowsmacOS
Malware Enterprise

S0438: Attor

Attor is a Windows-based espionage platform that has been seen in use since 2013. Attor has a loadable plugin architecture to customize functionality for specific targets.[1]

Windows
Campaign Enterprise

C0055: Quad7 Activity

Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. [1] [2] The botnet was initially composed primarily of TP-Link routers and was named Quad7 due to compromised devices exposing TCP port 7777 with the distinctive banner xlogin. Later activity showed a significant increase in compromised Asus routers and the addition of new ports and banners, including TCP port 63256 displaying alogin. Quad7 infrastructure functions as a collection of egress IPs that various China-affiliated threat actors have used to conduct password-spraying and brute-force operations. [1][3] Microsoft has reported that Storm-0940 leveraged credentials obtained through Quad7 Activity to target organizations in North America and Europe, including government agencies, non-governmental organizations, think tanks, law firms, energy firms, IT providers, and defense industrial base entities. [2]

Campaign Enterprise

C0006: Operation Honeybee

Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.[1]

Relationship explorer

All related ATT&CK context

uses · Malware S0428: PoetRAT Enterprise subtechnique of · Technique T1071: Application Layer Protocol Enterprise uses · Malware S1242: Qilin Enterprise uses · Group G0096: APT41 Enterprise uses · Tool S0699: Mythic Enterprise uses · Campaign C0055: Quad7 Activity Enterprise uses · Tool S0465: CARROTBALL Enterprise uses · Malware S0019: Regin Enterprise detects · Detection Strategy DET0416: Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP) Enterprise uses · Malware S1228: PUBLOAD Enterprise uses · Malware S0409: Machete Enterprise mitigates · Mitigation M1037: Filter Network Traffic Enterprise uses · Malware S0161: XAgentOSX Enterprise uses · Malware S0201: JPIN Enterprise uses · Malware S0265: Kazuar Enterprise uses · Malware S0438: Attor Enterprise uses · Malware S1089: SharpDisco Enterprise uses · Campaign C0006: Operation Honeybee Enterprise uses · Malware S0412: ZxShell Enterprise uses · Malware S0596: ShadowPad Enterprise uses · Group G0035: Dragonfly Enterprise uses · Malware S0464: SYSCON Enterprise mitigates · Mitigation M1031: Network Intrusion Prevention Enterprise uses · Malware S1229: Havoc Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
69212144b2873ab9...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.4 Current bundle 69212144b287…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    US-CERT TA18-074A

    US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.

    Open source URL
  2. [2]
    ESET Machete July 2019

    ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.

    Open source URL
  3. [3]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  4. [4]
    mitre-attack T1071.002
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use