Identifies Telnet session activity where the attacker uses BusyBox ftpget to download a remote file from an external FTP server to the local filesystem. This pattern is commonly observed in IoT botnet propagation chains where BusyBox is leveraged to retrieve staged payloads (e.g., shell scripts or binary droppers) from attacker-controlled infrastructure.