TL;DR: Gootloader is delivered through deliberately malformed ZIP archives that evade many unarchiving and analysis tools, then hand off execution to JScript, PowerShell, and persistence mechanisms, according to Expel. The pattern shows that defenders need behaviour-based detections and execution controls, not just static file inspection.
At a glance
What this is: Expel shows how Gootloader uses malformed ZIP archives to evade common extraction and analysis tools while still enabling script execution on Windows hosts.
Why it matters: This matters because detection that stops at file reputation or static parsing can miss malware delivery paths that depend on execution behavior and Windows defaults.
Context
A malformed archive is a file that still opens for the intended user but breaks assumptions in automated parsing and analysis. In this case, the security gap is between what static tooling expects from a ZIP structure and what the Windows user experience will still tolerate.
That matters for enterprise detection and triage because malware operators can shape the delivery container to frustrate inspection without preventing the victim from opening it. The same pattern also creates an identity-adjacent control problem when local execution paths and default file associations become part of the attack path.
Expel’s analysis shows a familiar asymmetry: defenders rely on consistent file structure, while the attacker only needs one reliable execution path.
Key questions
Q: What breaks when malformed ZIP archives are used to deliver malware?
A: They break the assumption that every archive can be parsed consistently by automated tooling. When local headers, central directories, and end-of-directory records are intentionally inconsistent, some scanners fail before they ever inspect the payload. That gives the attacker time to reach execution on the victim host while defenders are still trying to normalize the file.
Q: Why do malformed archives still matter if the malware eventually runs in Windows?
A: Because the attacker is exploiting a control gap between analysis and execution. Windows defaults may still open the archive and launch the embedded script, while specialist extraction tools fail. The risk is not the archive by itself, but the way it routes the victim from download to script execution faster than security teams can analyze it.
Q: What do security teams get wrong about ZIP-based malware delivery?
A: They often stop at file reputation or hash matching, which fails when each victim receives a unique archive. The more reliable indicator is the post-extraction behavior: script execution from temporary paths, unusual use of WScript or CScript, and PowerShell launched from that ancestry. Detection needs to follow the process chain, not the file name.
Q: How should teams respond when a user opens a malicious script from an archive?
A: Contain the endpoint, preserve the file and process lineage, and check whether the script created startup persistence or spawned PowerShell. The immediate question is whether the host executed only the initial script or already progressed into follow-on activity. That distinction determines whether the event is a blocked attempt or an active foothold.
Technical breakdown
Why malformed ZIP structure breaks analysis
ZIP archives are parsed from the end of the file, where the central directory and End of Central Directory records tell tools how to locate content. Gootloader’s archive deliberately disrupts those expectations with truncated fields, concatenated archive data, and mismatched metadata between the local file header and the central directory. Many unarchiving tools reject that structure or misread it, which prevents automated inspection from reaching the payload. The malicious design does not need to defeat every parser. It only needs to break enough of the common analysis path to delay detection while preserving user execution on Windows.
Practical implication: Inspect malformed archive structure itself, not only the extracted payload.
How Windows defaults preserve the attack path
The archive is built to fail in some specialist tools but still work with the default Windows unarchiver. That matters because the attacker is optimizing for the victim’s operating environment, not for the analyst’s lab. Once opened, the archive exposes a JScript file that Windows Script Host can execute by default when the file is double-clicked. This makes the Windows file association part of the delivery chain. The result is a narrow but reliable path from download to script execution, even when other tools cannot consistently extract or validate the same file.
Practical implication: Review default script associations and block execution paths that start from downloaded archives.
Why process genealogy is the better detection layer
Static hash-based detection is weak here because the malware uses hashbusting, so each victim receives a unique file. The better signal is the process chain that follows execution: WScript or CScript launching JScript from a temporary or unusual path, then spawning PowerShell, and in some cases creating startup persistence through shortcut abuse. Behaviour-based detection survives file variation because the attacker must still execute the same workflow. That shifts the defender’s focus from the archive’s bytes to the malware’s operating pattern across file, script, and process layers.
Practical implication: Alert on script execution chains and persistence patterns instead of relying on file hashes.
Threat narrative
Attacker objective: The attacker wants to bypass defensive inspection long enough to execute a script, establish persistence, and create a reliable foothold for follow-on activity.
- Entry begins when the victim downloads a malformed ZIP archive that is designed to frustrate automated extraction and static inspection.
- Credential or execution abuse occurs when the archive is opened in Windows and the embedded JScript is launched through default script handling.
- Escalation and persistence follow when the script spawns PowerShell and creates startup-based shortcut activity to maintain execution across reboots.
- Impact is achieved when the malware establishes a foothold that can hand off access to a second-stage operator.
Breaches seen in the wild
- CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Malformed delivery containers are now an operational control problem, not just a file-format curiosity. The value of the ZIP abuse is not that it is technically exotic, but that it creates a gap between user execution and machine inspection. Defenders who treat archive parsing as a solved preprocessing step miss the fact that malformed structure can be a deliberate anti-analysis layer. The practical conclusion is to govern delivery paths, not only payloads.
Behaviour beats static reputation when the file is intentionally unique per victim. Hashbusting removes the usefulness of file-hash blocking and turns every download into a one-off artifact. That means the decisive control becomes process correlation, script ancestry, and execution-context analysis. Security teams should expect the attacker to rotate the container while keeping the execution chain stable.
Legacy Windows execution defaults remain a hidden governance debt. If a downloaded JScript can still execute through WScript or CScript, then the environment is preserving an attacker-friendly trust assumption. This is especially relevant to IAM-adjacent governance because local defaults and user-driven execution pathways can function as unauthorised runtime permissions. Teams should treat script associations and execution policy as part of their control baseline.
Detection failure here is a sequencing failure, not a visibility failure alone. The archive can be seen, but not always parsed, and the payload can be extracted, but not always understood in time. That is why sandboxing, content inspection, and endpoint telemetry need to be linked into one pipeline. Practitioners should design triage around the earliest reliable behavioral signal, not the first file artifact.
Archive evasion is a sign that malware authors are optimizing for analyst friction, not just infection success. The campaign’s structure shows that attackers know where human review and automated tooling disagree. Once that friction exists, the defender’s job is to reduce the number of handoffs between download, extraction, and execution. In practice, that means moving from artifact-centric inspection to control-centric containment.
What this signals
Malformed archive delivery is a reminder that secure file handling must be judged by the execution path it permits, not by whether a file can be opened in a lab. When the attack depends on Windows defaults and user-driven script launch, endpoint policy becomes part of the first-line control set.
The named concept here is archive parsing asymmetry: the attacker designs a file that breaks analysis before it breaks user execution. That gap is especially relevant for teams that rely on sandbox detonation or static extraction as the main triage filter.
For practitioners, the next step is to elevate process ancestry and script-association policy into detection engineering, because file-only controls will not hold against intentionally malformed containers.
For practitioners
- Harden script execution defaults Reassociate .js and .jse files to open in a text editor rather than WScript, and restrict execution of downloaded scripts where business use does not require them.
- Detect script execution from temporary paths Alert when WScript or CScript launches a JScript file from AppData\Local\Temp or another extraction path associated with archive handling.
- Block legacy shortname script execution Flag CScript executions that use NTFS shortnames, because that pattern is rare in normal user activity and appears in the malware chain described in the article.
- Correlate PowerShell ancestry with archive origin Treat cscript.exe spawning powershell.exe after archive-originated script execution as a high-confidence alert path and investigate the full lineage before allowing continuation.
Key takeaways
- Gootloader uses malformed ZIP archives to frustrate inspection while keeping Windows execution paths intact.
- The effective defence is behavioural detection, because unique archives and hashbusting undermine static file-based controls.
- Teams should harden script associations and alert on archive-originated script execution before the chain reaches PowerShell or persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article focuses on malware delivery, script execution, and follow-on foothold behavior that maps to adversary technique tracking. |
| Recommendation — Map the execution chain to ATT&CK and tune detections for script launch, PowerShell ancestry, and persistence activity. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | The article is fundamentally about malware evasion, endpoint behavior, and detection engineering. |
| Recommendation — Use malware defenses to alert on archive-originated script execution and unexpected PowerShell spawning. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potentially adverse events | Behavior-based detection and monitoring are the core defensive theme of the article. |
| Recommendation — Tune monitoring to catch abnormal process ancestry rather than relying on static file inspection alone. | ||
Key terms
- Malformed ZIP archive: A ZIP file deliberately constructed so that common parsers misread or reject it while the target operating system can still open it. Attackers use malformed fields, truncated metadata, and unusual structure to frustrate static analysis and speed up malicious execution.
- Hashbusting: A technique that changes a file’s observable properties so each delivered sample has a different hash or fingerprint. In malware delivery, this reduces the value of signature matching and sample correlation, forcing defenders to rely on behaviour and structure instead of exact file identity.
- Process ancestry: The chain of parent and child processes that shows how one executable led to another. It is a critical detection signal because malware often reveals itself through unusual execution relationships, even when the files involved are new or obfuscated.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course.Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org