2026-01-20: VIP Recovery infection with FTP data exfiltration traffic

This report details a VIP Recovery malware infection identified on January 20, 2026, which specifically utilizes FTP traffic for the purpose of data exfiltration. The analysis focuses on the network behavior of the malware as it moves sensitive information from the compromised host to a remote server.

The provided forensic materials include a full packet capture (PCAP) of the infection event, the initial phishing email used to deliver the payload, and various malware artifacts. These resources are intended for security analysts to study the delivery mechanisms and communication protocols associated with this threat actor.

Read Full Article