Bots can use various methods to establish a line of communication between themselves and their command-and-control (C&C) server. Usually, these are done via HTTP or other TCP/IP connections. However, we recently encountered a botnet that uses a more unusual method: an FTP server that, in effect, acts as a C&C server.
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
SYSCON Backdoor Uses FTP as a C&C Channel