Gootloader Malware With Low Detection Rate Evades Most Security Tools

Gbhackers •Mayura Kathir • January 20, 2026

Gootloader malware has resurfaced, employing sophisticated evasion techniques to exploit malformed ZIP archives and obfuscation mechanisms to bypass security detection systems. The Gootloader malware campaign, tracked as a partnership between Storm-0494 and Vanilla Tempest, has returned in late 2025 with an alarming ability to evade detection. The threat operates through a specialized delivery mechanism a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gootloader Malware Resurfaces with Advanced Evasion Techniques Gootloader malware has reemerged as a significant threat, returning in November 2025 with enhanced capabilities to evade detection by security tools. The malware utilizes sophisticated evasion techniques, including exploiting malformed ZIP archives and obfuscation mechanisms, and operates as an initial access broker for ransomware attacks, facilitating entry points for other threat actors. 3 sources 48

Extracted Entities

Gootloader Malware With Low Detection Rate Evades Most Security Tools

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)