{
  "family": "tftpd",
  "sample_count": 3,
  "category": "ransomware",
  "description": "HackTool:Win32/Tftpd is a critical detection that flags the presence of an unauthorized Trivial File Transfer Protocol (TFTP) daemon (server) running on a Windows endpoint. While TFTP is a legitimate protocol often used for booting network devices (PXE), its lack of authentication or encryption makes it incredibly dangerous on a standard workstation. Attackers and worms heavily abuse TFTP to rapidly transfer malicious payloads into a compromised network.<br><br><b>Understanding Tftpd (Ingress Tool Transfer)</b><br>To an end-user, a running TFTP daemon is completely invisible. For a security administrator, this detection is a major red flag. It indicates that an attacker (or an automated worm like Blaster) has already achieved Remote Code Execution (RCE) on the endpoint and has intentionally spun up a TFTP server to pull down the rest of their toolkit (`T1105`), bypassing perimeter firewalls that might block inbound HTTP or FTP traffic.<br><br><b>Execution and Transfer Mechanics</b><br>A TFTP daemon is usually dropped onto a system after initial exploitation (`T1190`). For example, an attacker exploiting a vulnerability will send a small initial payload (shellcode). This shellcode then writes a tiny TFTP client or server (like `tftpd32.exe`) to the disk and executes it. The attacker then connects to this unauthenticated daemon over UDP port 69 and pushes their heavy payloads: keyloggers, ransomware, or persistent backdoors (`T1105`). Because TFTP uses UDP and requires no login, the transfer is fast and often evades basic network logging.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the facilitation of severe secondary infections. Host-based IoCs include the presence of known TFTP server executables (like `tftpd32.exe` or `tftpd64.exe`) in the `%Temp%` or `System32` directories, and EDR alerts for unverified processes opening listening sockets on UDP port 69. Network IoCs include anomalous inbound or outbound UDP traffic on port 69, especially originating from standard workstations rather than network infrastructure servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1190",
    "T1571"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Using TFTP to download payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1571",
      "name": "Non-Standard Port (Abusing UDP 69 for C2/Transfer)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Often the precursor to dropping a TFTP daemon)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately terminate the TFTP daemon process (e.g., `tftpd32.exe`) to sever the attacker's file transfer channel.",
    "Isolate the endpoint and investigate what files were transferred via TFTP to identify the secondary payloads.",
    "Ensure that UDP port 69 is blocked at the perimeter firewall for all inbound and outbound traffic, except for authorized infrastructure servers.",
    "Perform a full forensic review of the endpoint to determine how the attacker achieved the initial RCE required to install the daemon."
  ],
  "what_to_avoid": [
    "Do not ignore the alert; a TFTP daemon on a workstation is almost never legitimate and guarantees an active compromise.",
    "Avoid simply deleting the TFTP executable without investigating the root cause of the initial infection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}