Loading story…
Attackers have been delivering malware in compressed archives that unpack into abnormally large executables, using zero-filled padding and nested container formats to push files beyond common endpoint detection and sandbox scanning limits. Researchers described ZIP archives as small as 2 MB to 2.5 MB expanding into ISO images or PE files hundreds of megabytes to more than 2 GB in size, even though the functional malware payload was often only about 1 MB to 1.8 MB once the appended overlay was removed. The technique exploits the fact that some EDR products and analysis pipelines skip or time out on files above thresholds such as 1 GB or 2 GB.
Multiple campaigns used the approach to deliver commodity malware including BitRAT, LokiBot, and other .NET payloads. In one case, analysts extracted a BitRAT sample with configuration pointing to kot-pandora[.]duckdns[.]org:24993, version 1.38, TOR process name tor, and password d6723e7cd6735df68d1ce4c704c29a04; in another, a phishing lure named "Purchase Order pdf.zpaq" used the uncommon ZPAQ format to drop a 1 GB executable that fetched an obfuscated payload from MediaFire. Separate malspam also paired ZIP and ISO files with social-engineering tricks, including malformed sender headers that made Outlook display only a trusted-looking name, showing how archive inflation and phishing deception are being combined to reduce detection and increase user execution.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Gatewatcher analyzed a likely malicious PE file inflated to about 2.1 GB with zero-byte padding, allowing it to compress into a 2.5 MB ZIP while potentially exceeding common EDR file-size scanning thresholds. The write-up said the technique is not new but is resurfacing as attackers adapt to widespread EDR deployment.
A phishing attempt captured by a honeypot used a ZPAQ archive named "Purchase Order pdf.zpaq," an uncommon format that common Windows tools could not decompress. Extraction with zpaq revealed a 1 GB .NET executable that appeared to download an obfuscated payload from a MediaFire URL, consistent with oversized-file evasion tactics.
A malicious email-delivered 2 MB ZIP archive contained an ISO with a 400 MB PE file whose size was inflated by a 99% zero-filled overlay. After stripping the padding, the analyst identified the 1.8 MB .NET executable as BitRAT and extracted configuration including version 1.38 and C2 kot-pandora[.]duckdns[.]org:24993.
A phishing email captured by a spam trap delivered LokiBot via a ZIP archive containing an ISO and NSIS-built executable, while also abusing a non-RFC-compliant From header that made Outlook show only a trusted-looking sender name. The malware decoded and loaded LokiBot in memory, attempted persistence and data theft, and its C2 returned HTTP 404 responses at the time of analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
gatewatcher.com
Open sourceisc.sans.edu
Open sourceisc.sans.edu
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that malware operators, including **Emotet** and **QBot**, have increasingly used **binary padding** to evade sandbox analysis and frustrate reverse engineering by inflating portable executable files with junk data while preserving functionality. The technique alters file hashes and can be applied through PE overlays, padded resource sections, gaps between sections, or oversized variables; low-entropy bytes such as repeated `00` values are especially effective because they compress well inside ZIP archives. Researchers also highlighted a compressed-padding variant known as **PufferPhishing**, which produces unusually large binaries that remain practical to deliver through phishing attachments. Emotet campaigns illustrate how the tactic fits into broader phishing-driven intrusion chains. Recent outbreaks used malicious Office documents and Excel 4.0 macros to trick users into enabling content, then downloaded DLL payloads from hardcoded or macro-generated URLs and executed them with tools such as **`regsvr32.exe`** or **`rundll32.exe`**. In one documented case, an Emotet DLL grew from about **616 KB** to **548.1 MB** through `00`-byte padding before being compressed for delivery, while post-infection activity included credential theft, spam distribution, reconnaissance, and process hollowing. Historical reporting also tied payload inflation to groups such as **BRONZE BUTLER**, showing that file-padding and oversized-payload evasion have been used across multiple malware operations for years.
Aug 15, 2026
A newly published archive-parsing weakness, **CVE-2026-0866** (dubbed **“Zombie ZIP”**), enables attackers to craft **malformed ZIP files** that can evade many antivirus and EDR scanners by manipulating ZIP header metadata. The technique sets the ZIP entry’s compression method to `STORED` while the embedded content remains **DEFLATED**, causing security tools that trust the header to **skip decompression and scanning**, resulting in false negatives. The malformed archives also typically fail to open or extract with standard ZIP utilities, which may surface errors such as CRC or unsupported method failures. Technical analysis shows the inconsistency can be detected by inspecting ZIP record metadata (e.g., `STORED` entries where compressed and uncompressed sizes differ) and by using tooling that bypasses standard ZIP libraries to parse raw records and forcibly decompress data. The SANS ISC write-up demonstrates analysis workflows and updates to *zipdump.py* (including a `forcedecompress` capability) to recover the hidden payload (illustrated with an embedded **EICAR** test file), while reporting indicates real-world abuse would likely pair the malformed archive with a **custom loader** that ignores the falsified header and directly extracts/decompresses the concealed content for execution.
Jun 29, 2026
Threat researchers reported that **Gootloader**, a malware loader frequently used for **initial access** ahead of ransomware deployment, is being delivered in a **deliberately malformed ZIP archive** designed to frustrate automated inspection and analyst workflows. The archive contains a malicious **JScript** that initiates infection; when executed, it can spawn **PowerShell** to continue execution and establish persistence. The malformed ZIP causes common unpacking tools (including *7-Zip* and *WinRAR*) to fail extraction, while the **Windows built-in ZIP handler** can still open the file—allowing victims to extract and run the payload while hindering defender tooling that relies on standard decompression libraries.
Jun 29, 2026