GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites

According to Huntress, the malware known as GootLoader has resurfaced, with three infections observed since 27 October 2025, two of which involved hands-on keyboard intrusions and domain controller compromise within 17 hours of initial infection. It is described as leveraging custom WOFF2 fonts with glyph substitution to obfuscate filenames displayed in the browser, while exploiting WordPress comment endpoints to deliver XOR-encrypted ZIP payloads with unique keys per file.

GootLoader is affiliated with a threat actor tracked as Hive0127 (aka UNC2565) and is typically distributed through SEO poisoning to deliver additional payloads, including ransomware. The latest findings also note a new technique that hides the ZIP archive by making it unpack as a harmless TXT file for some tools, while the embedded JavaScript payload deploys Supper, a backdoor with remote control and SOCKS5 proxying capabilities.

The group has previously used methods such as WinRM for lateral movement to a Domain Controller to create an admin-level user, and researchers emphasise the obfuscation plus the custom font approach to defeat static analysis.