GootLoader uses malformed ZIP files to bypass security controls

This report describes GootLoader’s use of intentionally malformed ZIP files—hundreds of concatenated ZIPs with randomized metadata—to evade analysis and deliver JavaScript loaders that lead to payloads (including ransomware families like REvil and SunCrypt). It explains the infection chain (browser-decoded data → Windows unarchiver → JScript via wscript/cscript → PowerShell and persistence), provides detection recommendations (monitor wscript/cscript execution from Temp, LNK creation in Startup, and suspicious process chains), and links the activity to tracked actors (UNC2565/Vanilla Tempest).