{
  "family": "tftpd",
  "sample_count": 3,
  "category": "ransomware",
  "description": "HackTool:Win32/Tftpd is a critical detection that flags the presence of an unauthorized Trivial File Transfer Protocol (TFTP) daemon (server) running on a Windows endpoint. While TFTP is a legitimate protocol often used for booting network devices (PXE), its lack of authentication or encryption makes it incredibly dangerous on a standard workstation. Attackers and worms heavily abuse TFTP to rapidly transfer malicious payloads into a compromised network.<br><br><b>Understanding Tftpd (Ingress Tool Transfer)</b><br>To an end-user, a running TFTP daemon is completely invisible. For a security administrator, this detection is a major red flag. It indicates that an attacker (or an automated worm like Blaster) has already achieved Remote Code Execution (RCE) on the endpoint and has intentionally spun up a TFTP server to pull down the rest of their toolkit (`T1105`), bypassing perimeter firewalls that might block inbound HTTP or FTP traffic.<br><br><b>Execution and Transfer Mechanics</b><br>A TFTP daemon is usually dropped onto a system after initial exploitation (`T1190`). For example, an attacker exploiting a vulnerability will send a small initial payload (shellcode). This shellcode then writes a tiny TFTP client or server (like `tftpd32.exe`) to the disk and executes it. The attacker then connects to this unauthenticated daemon over UDP port 69 and pushes their heavy payloads: keyloggers, ransomware, or persistent backdoors (`T1105`). Because TFTP uses UDP and requires no login, the transfer is fast and often evades basic network logging.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the facilitation of severe secondary infections. Host-based IoCs include the presence of known TFTP server executables (like `tftpd32.exe` or `tftpd64.exe`) in the `%Temp%` or `System32` directories, and EDR alerts for unverified processes opening listening sockets on UDP port 69. Network IoCs include anomalous inbound or outbound UDP traffic on port 69, especially originating from standard workstations rather than network infrastructure servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Tftpd and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tftpd is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tftpd establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tftpd typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Tftpd compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Tftpd should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Tftpd employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tftpd typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Tftpd, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Tftpd depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1190",
    "T1571"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Using TFTP to download payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1571",
      "name": "Non-Standard Port (Abusing UDP 69 for C2/Transfer)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Often the precursor to dropping a TFTP daemon)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately terminate the TFTP daemon process (e.g., `tftpd32.exe`) to sever the attacker's file transfer channel.",
    "Isolate the endpoint and investigate what files were transferred via TFTP to identify the secondary payloads.",
    "Ensure that UDP port 69 is blocked at the perimeter firewall for all inbound and outbound traffic, except for authorized infrastructure servers.",
    "Perform a full forensic review of the endpoint to determine how the attacker achieved the initial RCE required to install the daemon."
  ],
  "what_to_avoid": [
    "Do not ignore the alert; a TFTP daemon on a workstation is almost never legitimate and guarantees an active compromise.",
    "Avoid simply deleting the TFTP executable without investigating the root cause of the initial infection."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}