Tftpd

Overview

HackTool:Win32/Tftpd is a critical detection that flags the presence of an unauthorized Trivial File Transfer Protocol (TFTP) daemon (server) running on a Windows endpoint. While TFTP is a legitimate protocol often used for booting network devices (PXE), its lack of authentication or encryption makes it incredibly dangerous on a standard workstation. Attackers and worms heavily abuse TFTP to rapidly transfer malicious payloads into a compromised network.

Understanding Tftpd (Ingress Tool Transfer)
To an end-user, a running TFTP daemon is completely invisible. For a security administrator, this detection is a major red flag. It indicates that an attacker (or an automated worm like Blaster) has already achieved Remote Code Execution (RCE) on the endpoint and has intentionally spun up a TFTP server to pull down the rest of their toolkit (`T1105`), bypassing perimeter firewalls that might block inbound HTTP or FTP traffic.

Execution and Transfer Mechanics
A TFTP daemon is usually dropped onto a system after initial exploitation (`T1190`). For example, an attacker exploiting a vulnerability will send a small initial payload (shellcode). This shellcode then writes a tiny TFTP client or server (like `tftpd32.exe`) to the disk and executes it. The attacker then connects to this unauthenticated daemon over UDP port 69 and pushes their heavy payloads: keyloggers, ransomware, or persistent backdoors (`T1105`). Because TFTP uses UDP and requires no login, the transfer is fast and often evades basic network logging.

Indicators of Compromise & Impact
The impact is the facilitation of severe secondary infections. Host-based IoCs include the presence of known TFTP server executables (like `tftpd32.exe` or `tftpd64.exe`) in the `%Temp%` or `System32` directories, and EDR alerts for unverified processes opening listening sockets on UDP port 69. Network IoCs include anomalous inbound or outbound UDP traffic on port 69, especially originating from standard workstations rather than network infrastructure servers.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_TFTPD_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tftpd"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "tftpd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Tftpd (Ransomware) Execution & Triage
id: 6eb5407f-dc7d-55b6-b4ef-1bb83c8ecd56
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Tftpd malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/tftpd
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1105
- attack.t1190
- attack.t1571
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_TFTPD_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tftpd tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "tftpd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately terminate the TFTP daemon process (e.g., `tftpd32.exe`) to sever the attacker's file transfer channel.
2. Isolate the endpoint and investigate what files were transferred via TFTP to identify the secondary payloads.
3. Ensure that UDP port 69 is blocked at the perimeter firewall for all inbound and outbound traffic, except for authorized infrastructure servers.
4. Perform a full forensic review of the endpoint to determine how the attacker achieved the initial RCE required to install the daemon.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the alert; a TFTP daemon on a workstation is almost never legitimate and guarantees an active compromise.
2. Avoid simply deleting the TFTP executable without investigating the root cause of the initial infection.

References & External Analysis

• Search "tftpd" on VirusTotal (External Analysis)
• Search "tftpd" on Any.Run (Sandbox Sandbox)
• Search "tftpd" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Zjaisino
• Wyhymyz
• Sixmuch
• Mosu
• Rz0A4Oaeuqdi
• Rietspoof
• Vidro
• Crypton

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/tftpd.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.