Gootloader Returns After 7-Month Hiatus: SEO Poisoning, Glyph-Swapped Fonts, and a Dual-Personality Malformed ZIP (2025)

What Happened

Gootloader is a JavaScript-based initial-access malware loader active since 2020 that spreads via SEO-poisoned and compromised websites promising free legal/business document templates. A pseudonymous independent researcher who tracks and disrupts the operation (filing abuse reports against its hosting/ISP infrastructure) told BleepingComputer his efforts caused the operation to go quiet on March 31, 2025. On November 5, 2025, the researcher and Huntress Labs analyst Anna Pham reported Gootloader had returned; Huntress said it had already observed three infections since October 27, 2025, two of which escalated to hands-on-keyboard network intrusions. The relaunched campaign used the same core lure (fake legal-document-template sites ranking for niche search queries) but added significant new evasion tradecraft: a custom, Z85-encoded WOFF2 web font with swapped glyph vector paths that makes malicious filenames render as normal document names in the browser while appearing as gibberish in raw HTML/source; a deliberately malformed ZIP archive whose corrupted End-of-Central-Directory and mismatched Local-File-Header/Central-Directory metadata cause Windows' built-in unarchiver to extract a working malicious .js file while 7-Zip, WinRAR, Python's zipfile, and VirusTotal extract a harmless decoy .txt from the identical bytes; and a cloaking/gating system that serves visitors who fail its filters (wrong locale/OS, suspected bots, off-hours) a decoy blog post the researcher describes as "often AI-generated, likely via ChatGPT or similar tools." The researcher's blog reported the relaunch spanning 100+ websites and thousands of unique keywords. Huntress linked the loader to Storm-0494, which hands off access to ransomware affiliate Vanilla Tempest, with the Supper SOCKS5 backdoor serving as the post-exploitation tunneling tool observed in the access chain toward ransomware staging.

How the Attack Worked

Gootloader's chain begins with SEO poisoning (and, in an earlier 2025 wave predating the hiatus, some malicious search ads) that push compromised or attacker-built WordPress sites to the top of results for long-tail legal/business queries (Huntress's example: a user searching Bing for "missouri cover utility easement roadway" landed on the #1 result, a compromised site serving the payload). The page mimics a free legal-document-template site with a "Get Document"/"Download" button. Clicking it fires a POST request to WordPress's native comment endpoint (/wp-comments-post.php, parameter comment_post_ID={document_id}) - abusing legitimate site functionality to serve the payload while showing the victim a fake download-progress popup. The response is an XOR-encrypted ZIP archive, decrypted client-side with a key hardcoded in the page and unique to each of the five offered document names. The ZIP itself is deliberately malformed: its End-of-Central-Directory record is missing mandatory bytes and its Local File Header and Central Directory entries deliberately mismatch, so Windows' built-in unarchiver (which most victims use by default) extracts a working .JS JScript file, while 7-Zip, WinRAR, Python's zipfile, and VirusTotal parse the identical bytes into a harmless decoy .TXT - hiding the real payload from sandboxes and analysts while keeping it functional for the intended victim. On top of that, the JavaScript on the lure page renders filenames using a custom, Z85-encoded WOFF2 web font whose glyph vector-paths are deliberately swapped (the glyph named 'O' actually draws an 'F', 'a' draws 'l', etc.) so the rendered filename looks like a normal document name in the browser while the raw HTML/source contains meaningless character strings - defeating keyword-based detection for terms like "invoice" or "contract." The site also runs a cloaking/gating layer: visitors who fail its filters (non-English locale, non-Windows OS, suspected bots, off-hours traffic, etc.) are instead served a harmless decoy blog post that the researcher's blog describes as "often AI-generated, likely via ChatGPT or similar tools," rather than the malicious download flow. When the victim double-clicks the extracted .js file, Windows Script Host runs it directly from a temp folder, triggering an obfuscated JScript loader that spawns PowerShell and pulls further payloads (historically Cobalt Strike, GootBot, and various backdoors). Huntress ties current Gootloader activity to Storm-0494 (Microsoft/MSTIC's designation), which hands access to Vanilla Tempest; part of that post-exploitation toolkit is the Supper SOCKS5 backdoor/proxy (heavily obfuscated with API hammering, runtime shellcode construction, API hashing, and custom 2-byte LZMA compression), used for remote access and tunneling ahead of ransomware staging (Rhysida, BlackCat, Zeppelin, Quantum Locker have all followed Gootloader intrusions historically). Persistence shifted from scheduled tasks to Windows Startup-folder .lnk files using 8.3 short filenames. Post-infection timelines were fast: Huntress observed reconnaissance beginning within 20 minutes and domain-controller compromise in as little as 17 hours (16h54m) in one case; separately, for this same November 2025 wave, The DFIR Report shared with Huntress an observation of lateral movement toward a domain controller within one hour of initial JavaScript execution in a distinct intrusion - a different, more recent data point than The DFIR Report's own separately cited 2024-published writeup of an older February 2023 intrusion, which documented a roughly nine-hour timeline to Cobalt Strike deployment.

The Lure & the Tell

Lure: a page that ranks #1 (via SEO poisoning, and per historical reporting also sometimes paid search ads) for a specific, often obscure legal/business search query (e.g., an NDA template, a state-specific utility-easement agreement) and offers a free downloadable document via a "Get Document"/"Download" button - exploiting the fact that users searching for legal templates want something fast and trust top-ranked/official-looking results. Tell: the "document" arrives as a ZIP archive rather than a PDF/DOCX; inside is a file with a .js extension disguised to look like a document name (e.g., "mutual_non_disclosure_agreement.js"); the filename may look garbled if copied/inspected due to the glyph-swapped WOFF2 font; the ZIP itself misbehaves or shows different contents if opened with anything other than Windows' built-in extractor; and double-clicking the file launches Windows Script Host (wscript.exe) rather than opening a document viewer - all signs that a "legal template" is in fact an executable script.

Outcome

No breach notification, named victim organization, or financial loss was publicly disclosed for this specific 2025 return - this is vendor/independent-researcher threat intelligence, not a disclosed breach. What is documented: Huntress recorded at least three Gootloader infections starting October 27, 2025, two of which escalated to hands-on-keyboard intrusions with domain-controller compromise (in as little as 17 hours in one case, and under one hour to lateral movement toward a DC in a separate intrusion during this same wave, per an observation The DFIR Report shared directly with Huntress - distinct from The DFIR Report's own separately cited 2024 writeup of an older, February 2023 intrusion). Researchers (the pseudonymous "Gootloader" tracker, Huntress's Anna Pham, and later Expel) published detailed technical breakdowns and a YARA rule to detect the malformed-ZIP pattern, and the operation's ZIP-evasion technique continued to evolve into 2026 (a January 2026 Expel/BleepingComputer follow-up documented archives concatenating 500-1,000 ZIP parts). The campaign remains an active, ongoing initial-access threat rather than a closed incident with a final tally.

Why It Matters

This case shows that "check if the search result looks legitimate" is no longer sufficient defense: Gootloader's operators specifically poison long-tail, low-competition search queries so their fake sites rank #1, exploiting exactly the trust users place in top organic results. It also illustrates how file-format ambiguity itself becomes a social-engineering and evasion tool: the same bytes are simultaneously "safe" to automated scanners and "dangerous" to the human double-clicking it in Explorer, which defeats a huge swath of sandboxing and threat-intel tooling used to warn defenders in time. The glyph-substitution font trick further shows that visual/rendered content and underlying source content can now be deliberately decoupled - a technique with clear generalization risk beyond this one loader. The reported use of likely-AI-generated decoy content in the cloaking layer is a smaller but notable data point that commodity generative tools are being folded into even the supporting infrastructure of established, non-AI-native malware operations. Finally, the case is a clean illustration of the initial-access-broker ecosystem: a single unverified template download can cascade, within hours, into domain-controller compromise and ransomware deployment by an entirely separate criminal group (Vanilla Tempest), which is why user-level social engineering training and technical controls (disabling default JS execution) both matter even for "routine" downloads.

Defenses

Huntress and Expel recommend: (1) change the default Windows handler for .js/.jse files from WScript to Notepad via GPO so double-clicking a downloaded script can't auto-execute it; (2) monitor for wscript.exe/cscript.exe executing files out of %AppData%LocalTemp or spawning powershell.exe with -enc/-e flags - the core Gootloader execution pattern; (3) detect the malformed-ZIP structure itself (Expel published a YARA rule matching the repeated Local File Headers and truncated/duplicated End-of-Central-Directory records unique to Gootloader's archives); (4) treat any ZIP that extracts differently across tools (Windows Explorer vs. 7-Zip/WinRAR/Python zipfile/VirusTotal) as a red flag rather than a benign quirk; (5) user awareness that top-ranked search results/ads for "free" legal or business document templates are a known poisoning target, especially niche/long-tail legal queries; (6) EDR visibility into Startup-folder persistence (.lnk with Windows 8.3 short filenames) since Gootloader moved off scheduled tasks; (7) hunt for Supper SOCKS5 backdoor indicators (heavy API hammering/hashing, runtime shellcode construction, 2-byte LZMA-compressed C2) once Gootloader execution is confirmed, since it signals handoff toward Storm-0494/Vanilla Tempest ransomware staging.