Back Securityaffairs.Co

GootLoader uses malformed ZIP files to bypass security controls

Securityaffairs.Co •Pierluigi Paganini • January 18, 2026

GootLoader malware uses malformed ZIP files made of hundreds of concatenated archives to evade detection. GootLoader is used by ransomware actors for initial access, then handed off to others. Built to evade detection, it accounted for 11% of bypassing malware in the past years. GootLoader runs on an access-a-as-a-service model, it is used by different groups to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GootLoader Exploits Malformed ZIP Files to Evade Detection GootLoader malware utilizes malformed ZIP files composed of concatenated archives to bypass security measures. This technique has been linked to ransomware operations, including Vanilla Tempest, and is designed to evade detection by most security tools while being processed correctly by Windows' default unarchiver. Early detection is crucial to mitigate its impact. 2 sources 34

GootLoader uses malformed ZIP files to bypass security controls

The full story

Extracted Entities

Attack Types (1)

Malware (1)