Trend Labs highlights the EXPIRO file infector attacks that uses advanced routines to steal FTP credentials and other sensitive information:

QUOTE: An unusual attack has been spotted in the wild, using an unexpected combination of threats. This attack used exploit kits (in particular Java and PDF exploits) to deliver file infectors onto vulnerable systems. Interestingly, these file infectors have information theft routines, which is a behavior not usually found among file infectors. These malware are part of PE_EXPIRO family, file infectors that was first spotted in 2010. In addition to standard file infection routines, the variants seen in this attack also have information theft routines, an uncommon routine for file infectors.

About 70% of total infections are within the United States. It is possible that this attack was intended to steal information from organizations or to compromise websites, as the specific targeting of FTP credentials suggests either was possible. The combination of threats used is highly unusual and suggests that this attack was not an off-the-shelf attack that used readily available cybercrime tools.  Since this particular attack used exploits targeting vulnerabilities, we recommend users to update their systems with the latest security patches immediately. Trend Micro blocks the websites associated with this attack, as well as detecting the malware cited in this blog entry.