Cutwail

Overview

Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam-distributing botnets in computing history, first detected in 2007. Built as a modular dual-stage threat, Pushdo installs kernel-mode rootkits and injects stealthy communication modules into trusted processes, which then fetch the Cutwail spam engine to weaponize victim machines into distributed email transmission relays. At its peak between 2009 and 2010, the Cutwail botnet commanded an estimated 1.5 to 2 million active zombie endpoints, accounting for between 25% and 30% of all spam traffic globally—transmitting billions of rogue emails daily that distributed pharmaceutical scams, counterfeit goods, phishing hooks, and malware loaders. In August 2010, an international coalition of security researchers, FireEye, and tier-1 hosting providers severed 20 of Cutwail's primary command-and-control servers in a coordinated infrastructure disruption, temporarily cutting global spam volumes in half before the botnet operators introduced DGA fallbacks and SSL encryption.

Known aliases

Threat reports may refer to this family under multiple names:

• Cutwail
• Pushdo
• Pandex
• Win32/Cutwail
• Trojan.Pushdo

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Russian Cybercrime Syndicate / 2010 Global Infrastructure Takedown High confidence
  Basis: Operated by a sophisticated Russian-speaking cybercrime enterprise. Disrupted in August 2010 via multinational server seizures coordinated by security researchers and upstream ISPs, followed by extensive sinkholing of Pushdo DGA domains. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Pushdo Rootkit Downloader · Cutwail Modular Spam Engine · Cutwail Dga/Ssl Generation (2012-2015)

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2010-0188 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2012-0158 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5
• b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d

Delivery vectors

• Phishing campaigns with malicious attachments exploiting Adobe Reader (CVE-2010-0188) and Office (CVE-2012-0158)
• Drive-by downloads from compromised websites hosting exploit kits
• Infection via secondary downloaders like Andromeda and Upatre

Persistence mechanisms

• Creation of hidden Windows kernel drivers (.sys) in %SYSTEM32%\drivers
• Service creation and code injection into explorer.exe or svchost.exe

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CUTWAIL_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cutwail"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "cutwail" ascii wide nocase
        $s2 = "cutwail" ascii wide nocase
        $s3 = "pushdo" ascii wide nocase
        $s4 = "pandex" ascii wide nocase
        $s5 = "win32/cutwail" ascii wide nocase
        $s6 = "trojan.pushdo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Cutwail (Botnet) Execution & Triage
id: da5936aa-802d-53de-9b8f-534c5b086ed0
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Cutwail malware family. Detects firewall rule subversion, internal port
  proxying, and command-and-control keepalive polling indicative of botnet nodes.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/cutwail
- https://malware-families-catalog.systemhelpdesk.com/defensive/botnet-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.botnet
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1562_001
- attack.t1071_001
- attack.t1568_002
- attack.t1014
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \netsh.exe
    - \route.exe
    - \arp.exe
    - \ping.exe
    CommandLine|contains:
    - advfirewall firewall add rule
    - netsh interface portproxy
    - ping -n 1 127.0.0.1
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_CUTWAIL_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cutwail tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "cutwail" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and prevent the corporate IP from being blacklisted.
2. Enforce strict egress firewall rules blocking outbound SMTP traffic (TCP 25) from all endpoints, forcing traffic through authorized mail relays.
3. Utilize specialized anti-rootkit scanners or live memory forensics to identify and remove the hidden Cutwail drivers and injected processes.
4. Assume total endpoint compromise; perform a clean OS rebuild, as Cutwail's rootkit capabilities make manual remediation extremely unreliable.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the infection as a 'low severity' spam issue; being blacklisted will cause all legitimate corporate emails to be blocked globally.
2. Avoid relying on standard, user-mode antivirus scans; the rootkit component actively hides the malware from the operating system.

References & External Analysis

• MITRE ATT&CK - Pushdo / Cutwail (S0029)
• CISA Alert - Threat Actor Abuse of Cutwail Botnet
• NIST NVD - CVE-2010-0188
• Search "cutwail" on VirusTotal (External Analysis)
• Search "cutwail" on Any.Run (Sandbox Sandbox)
• Search "cutwail" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Botnet)

Explore other documented threats in the same operational category:

• Dorkbot
• Mirai
• Glupteba
• Simda
• Phorpiex
• Cybernetic
• Tordev
• Palevo

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/cutwail.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.