Gootloader Returns After a 7-Month Break: SEO Poisoning, a Homoglyph Masthead, Glyph-Swapped Fonts, and a Malformed ZIP That Only Windows Extracts (2025)

What happened

Gootloader is a JavaScript-based initial-access malware loader active since 2020 that spreads via SEO-poisoned and compromised websites promising free legal/business document templates. A pseudonymous independent researcher who tracks and disrupts the operation (filing abuse reports against its hosting/ISP infrastructure) told BleepingComputer his efforts caused the operation to go quiet on March 31, 2025. On November 5, 2025, the researcher and Huntress Labs analyst Anna Pham reported Gootloader had returned; Huntress said it had already observed three infections since October 27, 2025, two of which escalated to hands-on-keyboard network intrusions. The relaunched campaign kept the legal-document theme but changed what the victim actually sees. The poisoned page now has two states. A visitor who fails the site's gates gets a harmless blog post on their search term, which the researcher describes as "often AI-generated, likely via ChatGPT or similar tools." A visitor who passes watches the page redraw into an impersonation of a real institution: the researcher's worked example is a masthead reading "Tһе Υаle Law Jοurnаl", where the second letter of "The" is not a Latin h but the Cyrillic small letter shha. The redrawn page then offers several resources (PDFs, DOCX files, videos and PNGs) fitted to the search term, and every download link delivers the same zipped JScript. Two pieces of new evasion tradecraft sit behind that page: a custom, Z85-encoded WOFF2 web font whose glyph vector paths are swapped, so malicious filenames render as ordinary document names in the browser while the page source holds only gibberish; and a deliberately malformed ZIP whose truncated End of Central Directory and mismatched Local File Header and Central Directory metadata make Windows' built-in unarchiver produce a working .js file while other tools do not. What those other tools produce is where our sources part company, and the case should not flatten it. BleepingComputer and the researcher report that VirusTotal, Python's zip utilities and 7-Zip unpack a harmless-looking .txt of nearly the same name (Review_Hearings_Manual_202.txt against the real Review_Hearings_Manual_2025.js). The DFIR Report observation that Huntress relays says the opposite about that file: opened with 7-Zip, the archive "drops the malicious JavaScript file disguised as a .txt file." Expel, the only researcher to take the November archives apart, found neither, reporting that specialized tools such as 7-Zip and WinRAR fail to parse the file at all, and that the archive it examined held one file, the JScript, repeated 803 times, with no benign second file anywhere in it. The researcher's blog reported the relaunch spanning 100 websites and thousands of unique keywords. Huntress attributes use of Gootloader to Storm-0494, which grants the access it gains to the ransomware affiliate Vanilla Tempest, with the Supper SOCKS5 backdoor serving as the post-exploitation tunneling tool observed in the access chain toward ransomware staging.

How it worked

Gootloader's chain begins with SEO poisoning (and, in an earlier 2025 wave predating the hiatus, some malicious search ads) that push compromised or attacker-built WordPress sites to the top of results for long-tail legal/business queries (Huntress's example: a user searching Bing for "missouri cover utility easement roadway" landed on the #1 result, a compromised site serving the payload). For a visitor who clears the gates, the page redraws into a convincing imitation of a real institution and presents documents, videos and images as free resources on the searched topic; Huntress's example site offered five payloads, each behind a Download button. Clicking one fires a POST request to WordPress's native comment endpoint (/wp-comments-post.php, parameter comment_post_ID={document_id}), abusing legitimate site functionality to serve the payload while showing the victim a fake download-progress popup. The response is an XOR-encrypted ZIP archive, decrypted client-side with a key hardcoded in the page and unique to each of the five offered document names. The ZIP itself is deliberately malformed: its End of Central Directory record is missing two mandatory bytes, its Local File Header and Central Directory entries mismatch on CRC32, compressed and uncompressed size, and filename, and non-critical fields such as disk number are randomized so that every download is a different file. The asymmetry all sources agree on is that Windows' built-in unarchiver, which most victims use by default, produces a working .js file and other tools do not. What the other tools produce is disputed: BleepingComputer and the researcher describe a harmless-looking .txt surfacing in VirusTotal, Python's zip utilities and 7-Zip; the DFIR Report observation relayed by Huntress describes that .txt as the malicious JavaScript under a changed extension; and Expel's teardown of the November archives found the specialized tools failing outright, on an archive of 500 to 1,000 concatenated copies in which the same Local File Header and End of Central Directory each appear 803 times and no second file exists. WinRAR belongs in the group that fails, not the group that yields a .txt. On top of that, the JavaScript on the lure page renders filenames using a custom, Z85-encoded WOFF2 web font whose glyph vector-paths are deliberately swapped (the glyph named 'O' actually draws an 'F', 'a' draws 'l', etc.) so the rendered filename looks like a normal document name in the browser while the raw HTML/source contains meaningless character strings, defeating keyword-based detection for terms like "invoice" or "contract." The gating layer that decides which version of the page a visitor sees is inferred rather than documented: the researcher lists the likely conditions as being in an English-speaking country, using Windows, arriving from a search engine, and browsing during work hours. Visitors who fail get the harmless blog post, which he describes as "often AI-generated, likely via ChatGPT or similar tools," rather than the malicious download flow. When the victim double-clicks the .js file inside the opened archive, Windows Script Host runs it from the temporary folder Explorer creates for the ZIP's contents, triggering an obfuscated JScript loader that spawns PowerShell and pulls further payloads (historically Cobalt Strike, GootBot, and various backdoors). Huntress ties current Gootloader activity to Storm-0494 (Microsoft/MSTIC's designation), the actor that uses Gootloader for initial access and then grants that access to Vanilla Tempest; part of that post-exploitation toolkit is the Supper SOCKS5 backdoor/proxy (heavily obfuscated with API hammering, runtime shellcode construction, API hashing, and custom 2-byte LZMA compression), used for remote access and tunneling ahead of ransomware staging (Rhysida, BlackCat, Zeppelin, Quantum Locker have all followed Gootloader intrusions historically). Persistence shifted from scheduled tasks to a two-step shortcut chain: a .lnk in the Startup folder points to a second .lnk under %AppData%, which runs a second JScript file from that same folder, and Expel records that second stage running under CScript rather than WScript. The shortcuts name their targets by Windows 8.3 short filename (MOLECU1.LNK for Molecular Ecology.lnk, EMCCON1.JS for EMC ControlCenter.js), and each carries an assigned hotkey, CTRL+ALT+M and CONTROL+ALT+G in the cases Huntress saw, which the malware presses itself during the first infection to trigger execution. Post-infection timelines were fast: Huntress observed reconnaissance beginning within 20 minutes and domain-controller compromise in as little as 17 hours (16h54m) in one case; separately, for this same November 2025 wave, The DFIR Report shared with Huntress an observation of lateral movement toward a domain controller within one hour of initial JavaScript execution in a distinct intrusion, a different, more recent data point than The DFIR Report's own separately cited 2024-published writeup of an older February 2023 intrusion, which documented a roughly nine-hour timeline to Cobalt Strike deployment.

The lure and the tell

Lure: a page that ranks #1 (via SEO poisoning, and per historical reporting also sometimes paid search ads) for a specific, often obscure legal or business query, which redraws for visitors who pass its gates into what looks like a real institution's site, in the researcher's example a law journal whose masthead spells its own name with a Cyrillic letter, and offers PDFs, DOCX files, videos and images on the searched topic behind Download links. It runs on the assumption that someone hunting a niche legal form wants it quickly and trusts a top-ranked, official-looking result. Tell: the resource arrives as a ZIP rather than the PDF or DOCX advertised; inside is a file with a .js extension carrying a document-like name (Missouri_Utility_Easement_Guide_2023.js, Domestic_Partnership_Agreement_Template.js, Review_Hearings_Manual_2025.js are documented names from this wave); the filename shown on the page cannot be usefully copied or searched, because the characters in the source are gibberish that only the attacker's font renders as words; the archive will not open in 7-Zip, WinRAR or Python, or opens to something other than what Explorer shows; and double-clicking the file launches Windows Script Host (wscript.exe) rather than a document viewer. A legal template that behaves this way is an executable script.

Outcome

No breach notification, named victim organization, or financial loss was publicly disclosed for this specific 2025 return; this is vendor/independent-researcher threat intelligence, not a disclosed breach. What is documented: Huntress recorded at least three Gootloader infections starting October 27, 2025, two of which escalated to hands-on-keyboard intrusions with domain-controller compromise (in as little as 17 hours in one case, and under one hour to lateral movement toward a DC in a separate intrusion during this same wave, per an observation The DFIR Report shared directly with Huntress, distinct from The DFIR Report's own separately cited 2024 writeup of an older, February 2023 intrusion). Researchers (the pseudonymous "Gootloader" tracker, Huntress's Anna Pham, and later Expel) published detailed technical breakdowns. The YARA rule for the malformed-ZIP pattern is Expel's alone: the researcher's blog publishes no rule, and the YARA Huntress published covers the Supper backdoor. In January 2026, Expel published a deep technical breakdown, covered the same day by BleepingComputer, showing the actor's ZIP archives were built from 500 to 1,000 concatenated copies of the same archive. Expel's rule (gootloader_zip_archive_2025_11_17, created 2025-11-17) is described as consistently identifying the archives from November 11 through publication, with the author's own caveat attached: the methodology for creating these archives may change once the report is public. The campaign remains an active, ongoing initial-access threat rather than a closed incident with a final tally.

Why it matters

This case shows that "check if the search result looks legitimate" is no longer sufficient defense: Gootloader's operators specifically poison long-tail, low-competition search queries so their fake sites rank #1, exploiting exactly the trust users place in top organic results. It also illustrates how file-format ambiguity itself becomes a social-engineering and evasion tool: one archive is readable to the victim's default Windows extractor and unreadable, or misleading, to the tools defenders would analyze it with, which is enough to keep it out of the sandboxing and threat-intel pipelines meant to warn people in time. The glyph-substitution font trick further shows that visual/rendered content and underlying source content can now be deliberately decoupled, a technique with clear generalization risk beyond this one loader. The reported use of likely-AI-generated decoy content in the cloaking layer is a smaller but notable data point that commodity generative tools are being folded into even the supporting infrastructure of established, non-AI-native malware operations. Finally, the case is a clean illustration of the initial-access-broker ecosystem: a single careless template download can cascade, within hours, into domain-controller compromise and ransomware staging by an entirely separate criminal group (Vanilla Tempest), and in this wave the observed endpoint was preparation for encryption rather than encryption itself, which is why user-level social engineering training and technical controls (disabling default JS execution) both matter even for "routine" downloads.

Defenses

Expel's report carries the preventive and first-stage detection guidance: (1) change the default Windows handler for .js and .jse files from WScript to Notepad via GPO so double-clicking a downloaded script cannot auto-execute it, and block wscript.exe and cscript.exe from executing downloaded content where JScript is not needed; (2) monitor for wscript.exe executing a .js file out of %AppData%LocalTemp; (3) monitor for .lnk files created in the Startup folder that point at scripts in non-standard directories, and flag cscript.exe executing a .js file by its NTFS short name; (4) alert on the process tree cscript.exe to powershell.exe, and on the PowerShell instance that spawns a second PowerShell carrying an obfuscated command, which is the documented shape of this loader rather than an encoded-command flag; (5) detect the malformed-ZIP structure itself, using Expel's YARA rule matching the repeated Local File Headers and End of Central Directory records; (6) treat any ZIP that other tools cannot open, or that extracts differently in Windows Explorer than in 7-Zip, WinRAR, Python's zipfile or VirusTotal, as a red flag rather than a benign quirk. Huntress's own guidance is behavioral and post-execution: monitor for AD enumeration (Kerberoasting, SPN scanning), domain-wide local admin scanning, WinRM lateral movement, privileged account creation, and Volume Shadow Copy enumeration, and hunt for Supper SOCKS5 backdoor indicators (heavy API hammering and hashing, runtime shellcode construction, 2-byte LZMA-compressed C2) once Gootloader execution is confirmed, since it signals the handoff toward Vanilla Tempest ransomware staging. Separately, user awareness that top-ranked results and ads for free legal or business document templates are a known poisoning target, especially on niche long-tail queries, is the only control that bites before the download.