HTTP_VIP

HTTP_VIP is a native Windows downloader associated with the Iranian state-linked threat actor MuddyWater in Group-IB’s Operation Olalampo, first observed in January 2026. It was delivered through phishing campaigns using malicious Microsoft Office documents and macro-enabled lures, including themed documents such as airline tickets and reports, after victims were tricked into enabling macros. In documented attack chains, HTTP_VIP served as an initial downloader and command-and-control communicator that conducted system reconnaissance, connected to hardcoded external infrastructure including codefusiontech[.]org to authenticate, and deployed the legitimate remote management tool AnyDesk from the C2 server. Reported newer variants were capable of gathering victim information and instructions, executing commands via an interactive shell, transferring files, capturing clipboard contents, and updating sleep or beaconing intervals. The malware was part of a broader MuddyWater toolset in the campaign that also included GhostFetch, GhostBackDoor, and the Rust-based CHAR backdoor. Operation Olalampo primarily targeted organizations and individuals across the Middle East and North Africa, with broader reporting linking MuddyWater targeting to diplomatic, maritime, financial, telecom, and critical infrastructure sectors in countries including Israel, Egypt, the UAE, and Turkmenistan. A known infrastructure indicator directly mentioned for HTTP_VIP is codefusiontech[.]org.