Gootloader malware is back with new tricks after 7-month break

The Gootloader loader campaign has resurfaced after a seven-month hiatus, using SEO-poisoned websites and malicious ads that deliver malicious JScript files inside malformed ZIP archives to install loaders and follow-on payloads (Cobalt Strike, Supper SOCKS5 backdoor). Researchers observed evasion techniques—glyph-swapped web fonts to hide keywords in HTML and ZIP malformedness that yields different extraction results across tools—facilitating initial access for ransomware affiliates and rapid domain compromise across numerous compromised sites.