Delivery Method
The new Gootloader attacks use specially corrupted ZIP files as their delivery method. These ZIP files contain hundreds or even 1,000 smaller ZIP archives stitched together into one file. The trick works because different programs handle these files differently. Popular tools like 7-Zip and WinRAR will often crash or fail to open them, but Windows’ built-in ZIP opener works fine, letting the malware install on infected computers.
Security researchers from Huntress Labs, DFIR Report, and Expel say this activity restarted after about seven months of silence and shows the attackers spent time building better evasion methods. The corrupted archives use several techniques at once: they break a critical data structure called the End of Central Directory (EOCD) record, mess with disk number fields to fake multi-disk ZIP files, and create mismatches between two important parts of the ZIP structure (Local File Headers and Central Directory entries). Each victim also gets a completely unique ZIP file and JavaScript payload, making it much harder for security tools that rely on known file signatures or hash values to detect them.
The delivery method adds another layer of hiding. The ZIP data doesn’t arrive as a normal ZIP file. Instead, it’s encoded using XOR encryption and sent as scrambled binary data. The victim’s computer then decodes and rebuilds the ZIP file locally before extracting it. This lets the malware slip past network monitoring tools and analysis sandboxes that expect to see valid ZIP files.
Malware Attack
The attack launches through Windows Script Host (WScript), which runs the extracted JavaScript code. To stay on the system, it creates shortcut (.LNK) files in the Windows Startup folder. These shortcuts automatically run more JavaScript and PowerShell scripts every time the computer boots, keeping the infection active even if some parts get deleted.
Even though these corruption techniques are sophisticated, they leave behind detectable patterns. Expel has published a YARA rule (a type of detection signature) that spots these files by looking for unusual repetition in ZIP file headers and broken EOCD structures that almost never appear in real, legitimate archives.
To defend against this threat, security teams should lock down how scripts can run on Windows computers. Effective steps include: setting Notepad or another safe program as the default application for .js files, and blocking or restricting wscript.exe and cscript.exe from running downloaded scripts entirely. These controls can break Gootloader’s attack process while security teams update their detection rules to catch these parser-evasion techniques.