A short-lived email campaign distributing a variant of the Dridex banking Trojan indicates that cyber criminals are using compromised FTP sites to download malicious documents
http://www.computerweekly.com/news/252433528/Cyber-attackers-exploiting-trust-in-FTP-servers