Malformed & Dangerous: Gootloader Returns with New Ransomware Ties

According to Expel, after a mysterious hiatus the Gootloader malware has returned with a new alliance to ransomware operators and a delivery method designed to defeat automated tools by using a deliberately malformed ZIP archive. The report notes that the malware has long served to gain initial access, and now its delivery is engineered to bypass standard defenses while the threat is strengthening ties to the cybercriminal underworld.

It also highlights a claim that “the developer is working again with the threat actor tracked as Vanilla Tempest: an actor currently leveraging Rhysida ransomware,” a collaboration described as a dangerous convergence. The campaign’s hallmark is the use of NTFS shortnames, enabling the JavaScript payload to run via Windows Script Host, with a two‑stage PowerShell sequence that follows the initial CScript spawn.

Defenders are advised to focus detections on the process genealogy of Cscript spawning PowerShell, as understanding these techniques could turn the attacker’s camouflage into a detectable target.