Gootloader Malware With Low Detection Rate Evades Most Security Tools

Gootloader resurfaced in late 2025 using intentionally malformed ZIP archives (hundreds of concatenated archives and truncated End of Central Directory records) and hashbusting to bypass extraction and signature-based detection; the campaign delivers obfuscated JScript that uses WOFF2 Z85-encoded glyphs and NTFS 8.3 short-name LNK persistence to execute and escalate rapidly, facilitating lateral movement and ransomware deployment by affiliated criminal actors.