GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

Back Thehackernews

GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

Thehackernews •[email protected] (The Hacker News) • January 16, 2026

Share: View original

Discover how leading MSSPs use AI to automate security management, boost margins, and scale services without extra headcount.

Join cybersecurity leaders Kumar Saurabh and Francis Odum to learn how to build, buy, and automate smarter for a modern, efficient SOC.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gootloader Malware Evades Detection with Malformed ZIP Archives Gootloader, a malware loader used for initial access in ransomware attacks, employs a malformed ZIP archive to evade detection. This archive, which contains a JScript file, causes common unarchiving tools like 7zip and WinRAR to fail, while the default Windows utility can unpack it. This technique involves concatenating up to 1,000 archives to further complicate analysis. 5 sources 44

Extracted Entities

Attack Types (1)

Malware (1)