Gootloader with Low Detection Rate Bypasses Most Security Tools

Gootloader has reemerged as a significant threat, resurfacing in November 2025 with enhanced capabilities to bypass modern security systems.

Gootloader operates as an initial access broker, facilitating entry points for ransomware attacks. The malware is designed to evade detection while maintaining its functionality on compromised systems. It is currently being used by the threat actor group known as Vanilla Tempest in conjunction with Rhysida ransomware campaigns.

Technical Specifications and Evasion Techniques

The malware is distributed through compromised websites embedded within deceptive ZIP archives. These archives are deliberately malformed to confuse security tools. When users download what appears to be a legitimate document, they receive a file packed with hundreds of concatenated ZIP archives, designed to bypass both automated analysis and specialized extraction software.

The outer packaging is constructed so that most unarchiving tools, such as 7zip and WinRAR, cannot extract the contents. However, the default Windows unarchiver can open it, allowing victims to execute the payload while defenders struggle to analyze it.

Once the malicious ZIP file is opened, a JScript file embedded within executes automatically when double-clicked. This script runs through Windows Script Host and establishes persistence by creating link files in the user's Startup folder. These links point to a secondary JScript file stored in a random directory, ensuring the malware reactivates with every system restart. The JScript then spawns PowerShell with heavily obfuscated commands that communicate with attacker infrastructure to download secondary payloads.

The evasion strategy includes a technique called hashbusting, where every downloaded file contains unique characteristics. Each victim receives a completely different archive structure with randomized field values, making signature-based detection virtually impossible. Organizations cannot rely on file hashes or static patterns to identify these samples across their networks.

Prevent JScript execution through Group Policy Objects by reassociating .js files to Notepad instead of Windows Script Host. Monitor for suspicious PowerShell process chains. Detect NTFS shortname usage during script execution. Scan for malformed ZIP structures using specialized YARA rules.

Early detection at the ZIP delivery stage offers the best opportunity to prevent ransomware deployment before attackers gain deeper system access.

Based on reporting by Cyber Security News.