Huntress, Rhysida and Expel: Gootloader Malware Maintains Low Detection Rate While Bypassing Most Security Tools

Gootloader’s Sophisticated Anti-Detection Tactics Exposed in Latest Campaign

A recent analysis by Huntress and Expel reveals how the Gootloader malware leverages deliberately malformed ZIP archives to evade security tools while maintaining functionality for targeted victims. The threat actor, known for its role as an initial access broker in ransomware operations, has partnered with Vanilla Tempest, a group deploying Rhysida ransomware, in an ongoing campaign active since November 2025.

Evasion Through Malformed ZIP Archives

Gootloader’s infection chain begins with weaponized ZIP files containing malicious JScript payloads, such as "Indiana_Animal_Protection_Laws_Guide.js." These archives are engineered to bypass analysis tools like 7-Zip and WinRAR while remaining extractable via Windows’ native unarchiving utility.

Key evasion techniques include:

• Concatenated ZIP structures: Each archive contains 500–1,000 nested ZIP files, with the End of Central Directory (EOCD) record strategically placed to direct extraction to the valid payload.
• Truncated EOCD records: Missing critical bytes violate ZIP format standards, causing parsing failures in security tools.
• Randomized metadata: Mismatched version numbers, timestamps, CRC32 checksums, and file sizes between local file headers and central directory records further disrupt analysis.
• Client-side generation: Victims receive XOR-encoded data blobs decoded by browsers, assembling into identical ZIP structures until reaching 70–80 MB despite the extracted JScript payload being only ~287 KB.

Execution & Persistence

When victims extract and run the JScript file, Windows Script Host (WScript) processes it from AppData\Local\Temp, initiating a multi-stage attack:

1. Persistence: Creates LNK shortcuts in the Startup folder, referencing secondary scripts via NTFS short filenames (e.g., FILENA~1.js).
2. Obfuscated PowerShell execution: CScript launches the script, which spawns PowerShell processes with heavily obfuscated commands to establish command-and-control (C2) communications.

Detection & Indicators of Compromise

Security teams can identify Gootloader activity by monitoring:

• Process patterns: wscript.exe executing JScript from temp directories, followed by cscript.exe invoking scripts via NTFS shortnames and spawning PowerShell.
• File characteristics: ZIP archives with >100 instances of PK\x03\x04 (local file headers) or PK\x05\x06 (EOCD records).
• Persistence artifacts: LNK files in \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.

Known IOCs:

• File hash (SHA-256): b05eb7a367b5b86f8527af7b14e97b311580a8ff73f27eaa1fb793abb902dc6e
• Malicious extensions: .js, .jse
• Execution paths: Temp directories, NTFS shortname scripts

Gootloader remains a persistent threat, historically accounting for 11% of malware bypassing enterprise security solutions. Its collaboration with Vanilla Tempest underscores its role in facilitating Rhysida ransomware attacks.

Source: https://cyberpress.org/gootloader-malware-low-detection-security-bypass/

Huntress cybersecurity rating report: https://www.rankiteo.com/company/huntress-labs

Red Canary, a Zscaler company cybersecurity rating report: https://www.rankiteo.com/company/redcanary

Expel cybersecurity rating report: https://www.rankiteo.com/company/expel

"id": "HUNREDEXP1768977371",
"linkid": "huntress-labs, redcanary, expel",
"type": "Cyber Attack",
"date": "11/2025",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'attack_vector': 'Weaponized ZIP files with malicious JScript payloads',
 'data_breach': {'file_types_exposed': ['.js', '.jse']},
 'date_detected': '2025-11-01',
 'description': 'A recent analysis by Huntress and Expel reveals how the '
                'Gootloader malware leverages deliberately malformed ZIP '
                'archives to evade security tools while maintaining '
                'functionality for targeted victims. The threat actor, known '
                'for its role as an initial access broker in ransomware '
                'operations, has partnered with Vanilla Tempest, a group '
                'deploying Rhysida ransomware, in an ongoing campaign active '
                'since November 2025.',
 'initial_access_broker': {'backdoors_established': 'LNK shortcuts in Startup '
                                                    'folder, obfuscated '
                                                    'PowerShell C2 '
                                                    'communications',
                           'entry_point': 'Malformed ZIP archives with '
                                          'malicious JScript payloads'},
 'investigation_status': 'Ongoing',
 'lessons_learned': "Gootloader's use of malformed ZIP archives highlights the "
                    'need for improved detection of non-standard archive '
                    'structures and monitoring of script-based execution '
                    'chains.',
 'motivation': 'Initial access for ransomware operations (Rhysida ransomware '
               'deployment)',
 'post_incident_analysis': {'corrective_actions': 'Improved detection of '
                                                  'non-standard archive '
                                                  'formats, enhanced '
                                                  'monitoring of script-based '
                                                  'execution chains, and '
                                                  'PowerShell logging',
                            'root_causes': 'Exploitation of native Windows '
                                           'unarchiving utility to bypass '
                                           'security tools, use of malformed '
                                           'ZIP structures and obfuscated '
                                           'scripts for evasion'},
 'ransomware': {'ransomware_strain': 'Rhysida'},
 'recommendations': ['Monitor for wscript.exe executing JScript from temp '
                     'directories',
                     'Detect ZIP archives with >100 PK headers or truncated '
                     'EOCD records',
                     'Inspect LNK files in Startup folders for persistence',
                     'Block or scrutinize NTFS shortname script executions',
                     'Enhance PowerShell logging for obfuscated commands'],
 'references': [{'source': 'Huntress and Expel Analysis'}],
 'response': {'enhanced_monitoring': 'Monitoring for process patterns '
                                     '(wscript.exe, cscript.exe, PowerShell), '
                                     'file characteristics (ZIP archives with '
                                     '>100 PK headers), and persistence '
                                     'artifacts (LNK files in Startup folder)',
              'third_party_assistance': 'Huntress and Expel (analysis)'},
 'threat_actor': ['Gootloader', 'Vanilla Tempest'],
 'title': 'Gootloader’s Sophisticated Anti-Detection Tactics Exposed in Latest '
          'Campaign',
 'type': 'Malware Campaign',
 'vulnerability_exploited': 'Malformed ZIP archives evading security tools, '
                            'native Windows unarchiving utility exploitation'}