Loading story…
Threat researchers reported that Gootloader, a malware loader frequently used for initial access ahead of ransomware deployment, is being delivered in a deliberately malformed ZIP archive designed to frustrate automated inspection and analyst workflows. The archive contains a malicious JScript that initiates infection; when executed, it can spawn PowerShell to continue execution and establish persistence. The malformed ZIP causes common unpacking tools (including 7-Zip and WinRAR) to fail extraction, while the Windows built-in ZIP handler can still open the file—allowing victims to extract and run the payload while hindering defender tooling that relies on standard decompression libraries.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Expel disclosed technical details of GootLoader's first-stage delivery, explaining that the ZIP is reconstructed client-side from encoded data, uses per-download hashbusting, and abuses parser inconsistencies to evade automated analysis. The report also published defender guidance including YARA ideas, behavioral detections, and recommendations to restrict wscript/cscript and reassociate .js files away from Windows Script Host.
Reporting cited in the references linked the GootLoader developer's renewed activity to the threat actor tracked as Vanilla Tempest, which was using Rhysida ransomware. This connected the loader's return to likely rapid ransomware follow-on activity after initial access.
After resurfacing, GootLoader began using deliberately malformed ZIP archives made from roughly 500 to 1,000 concatenated ZIPs with randomized and damaged metadata. The files were engineered so common tools like 7-Zip and WinRAR often failed while Windows' built-in ZIP handler still opened them for victims.
Multiple references state that GootLoader returned in November 2025 after a period of reduced activity. The renewed campaigns featured updated delivery and execution methods designed to evade modern security controls.
One reference says active exploitation using GootLoader was observed since late 2023, with victims lured from search results to compromised WordPress sites hosting malicious ZIP files named after their queries. The infections ultimately delivered heavily obfuscated JavaScript payloads.
Reporting cited in the references says GootLoader has been evolving since at least 2020, including earlier delivery through SEO poisoning, malvertising, and compromised WordPress sites. This establishes the longer-running background of the malware loader before the newly described ZIP evasion technique.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcerescana.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourceexpel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented ongoing changes in **GootLoader**, a JavaScript-based initial-access malware family that infects Windows systems and is frequently linked to follow-on compromise with **Cobalt Strike** and ransomware. The malware is commonly distributed through **SEO poisoning** on compromised WordPress sites, where victims searching for agreement, contract, or form-related terms are redirected to fake forum pages and lured into downloading ZIP archives containing malicious JavaScript. When executed, the script establishes persistence with a scheduled task and uses PowerShell to beacon system information to multiple domains while awaiting additional payloads. Analysis of newer samples showed that GootLoader altered its obfuscation and code-rearrangement logic, breaking earlier indicator-extraction workflows that relied on a single statement pattern. Researchers updated decoder logic to capture several interdependent statements, merge extracted fragments, and preserve compatibility with older variants, while separate tooling was published to statically unpack three- and six-layer GootLoader scripts and extract command-and-control data without executing the malware. The combined work highlights an active malware ecosystem in which defenders must continuously adapt detection and IOC extraction methods as GootLoader changes its JavaScript structure and delivery tradecraft.
Aug 15, 2026
Gootloader operators compromised WordPress sites and implanted malicious PHP in theme files, plugin files, the `wp_options` table, and in some cases modified `xmlrpc.php` to selectively serve fake forum-style lure pages and malware only to filtered visitors. The infrastructure used gating based on factors such as geography, Windows user agents, logged-out status, and crawler checks, helping infected sites appear benign to most traffic. Compromised sites were observed contacting domains including `my-game.biz/5.8.18.7` to redraw pages and fetch malicious ZIP archives, while altered `xmlrpc.php` relays forwarded victim metadata to `inerino.co.za` and could return obfuscated PowerShell hidden in GIF responses. On victim systems, users commonly opened ZIP-delivered JScript files that launched via `wscript.exe` or `cscript.exe`, leading to PowerShell execution and in-memory loading of a .NET DLL. That DLL retrieved an obfuscated payload from the Windows Registry, decoded it, and executed follow-on malware including **Cobalt Strike**, **Gootkit**, and **Osiris**, showing Gootloader’s role as an initial access and malware delivery platform. Defenders were advised to watch for suspicious process chains involving `wscript.exe`, `cscript.exe`, `powershell.exe`, and `rundll32.exe` without arguments, and to reduce risk by changing JScript file associations and warning users about document-themed download lures.
Aug 15, 2026
Attackers operating the **Gootkit** loader compromised legitimate websites and used **SEO poisoning** to lure users searching for legal document templates into downloading malicious ZIP archives. The archives contained JavaScript that, once executed, launched obfuscated PowerShell and began a multi-stage infection chain designed to avoid writing the final payload to disk. Trend Micro reported that the updated intrusion flow used **registry stuffing**, **scheduled-task persistence**, and reflective in-memory loading to reconstruct and run a fileless **Cobalt Strike** beacon. The campaign differed from earlier Gootkit activity by shifting from freeware-themed lures to legal-document themes and by encrypting registry-stored content with a custom text-replacement algorithm instead of Base64; in the observed case, the beacon communicated with `89.238.185.13` before the attack was interrupted.
Aug 15, 2026