Gootloader with Low Detection Rate Bypasses Most Security Tools

Gootloader resurfaced in November 2025 as a sophisticated initial-access malware used by the threat actor group Vanilla Tempest to facilitate Rhysida ransomware; it delivers JScript inside deliberately malformed and concatenated ZIP archives that reliably execute on Windows while evading common analysis and detection, uses persistence via Startup link files and obfuscated PowerShell to fetch payloads, and employs "hashbusting" to thwart signature-based defenses — recommended mitigations include blocking JScript execution, monitoring PowerShell process chains and NTFS shortname usage, and scanning for malformed ZIP structures with YARA rules.