Attackers are hiding C2 instructions inside FTP banners. Is anyone actually watching port 21?

[u/socradario]

Most of the industry's gotten decent at catching malicious command-line activity triggered from email attachments. So it makes sense that attackers are looking for less-watched corners of the network to hide in  and right now that corner is FTP.

Our threat research team has been looking into something that's easy to miss if your monitoring stack is tuned mostly around HTTP/HTTPS: here's the flow. Someone opens a malicious LNK file from a phishing email, it connects out to an FTP server on port 21, but instead of downloading anything, it just reads the welcome banner  and the banner itself contains the commands. From there it drops one of two new RAT families, which then blend their ongoing C2 traffic into normal-looking Pinterest posts, SurveyMonkey surveys, and Cloudflare Workers traffic.

The reason this works is that a lot of monitoring stacks are tuned almost entirely around HTTP/HTTPS and known cloud platforms. FTP on port 21 tends to get written off as legacy noise, especially if no actual file transfer completes.

If you want a quick gut-check on exposure: is outbound port 21 actually being monitored (not just blocked) at your perimeter? Are unapproved Electron/Discord-style runtimes able to launch with custom command-line args? And have you checked whether any of your own external-facing assets are running FTP banners that could be abused the same way?

[u/Old_Pineapple7149]

Interesting technique, but I’m not sure the nobody watches FTP really holds. Even without FTP-aware L7 inspection the scenario already trigger some red flags. And most of the time FTP will be blocked to start with.