A recently discovered Dridex campaign had a few peculiar characteristics, including the use of FTP instead of HTTP.
Source: Threadpost