{
  "family": "cutwail",
  "sample_count": 92,
  "category": "botnet",
  "description": "Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam-distributing botnets in computing history, first detected in 2007. Built as a modular dual-stage threat, Pushdo installs kernel-mode rootkits and injects stealthy communication modules into trusted processes, which then fetch the Cutwail spam engine to weaponize victim machines into distributed email transmission relays.\n\nAt its peak between 2009 and 2010, the Cutwail botnet commanded an estimated 1.5 to 2 million active zombie endpoints, accounting for between 25% and 30% of all spam traffic globally—transmitting billions of rogue emails daily that distributed pharmaceutical scams, counterfeit goods, phishing hooks, and malware loaders. In August 2010, an international coalition of security researchers, FireEye, and tier-1 hosting providers severed 20 of Cutwail's primary command-and-control servers in a coordinated infrastructure disruption, temporarily cutting global spam volumes in half before the botnet operators introduced DGA fallbacks and SSL encryption.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Cutwail",
    "Pushdo",
    "Pandex",
    "Win32/Cutwail",
    "Trojan.Pushdo"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Cutwail / Pushdo botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cutwail (coupled with Pushdo) is a massive spam and malware distribution botnet that controlled millions of compromised systems and generated up to 30% of all worldwide spam at its peak."
      }
    },
    {
      "@type": "Question",
      "name": "What is the difference between Pushdo and Cutwail?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pushdo acts as the stealthy loader and rootkit that infects the computer, while Cutwail is the modular payload executed to send high-volume spam and steal credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How did Cutwail disguise its Command and Control traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cutwail sent hundreds of decoy HTTP requests to legitimate sites like Google, Yahoo, and universities alongside each real C2 beacon, confounding network anomaly detection."
      }
    },
    {
      "@type": "Question",
      "name": "How was the Cutwail infrastructure disrupted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In August 2010, an international collaborative effort took down 20 major C2 servers across multiple hosting providers, temporarily dropping worldwide spam volume by roughly 50%."
      }
    },
    {
      "@type": "Question",
      "name": "How can network administrators prevent Cutwail bot activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block direct outbound connections on port 25 (SMTP) from non-mail-server endpoints, patch Adobe Reader and Microsoft Office against known exploit vectors, and deploy reputation-based IP filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1562.001",
    "T1071.001",
    "T1568.002",
    "T1014",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and prevent the corporate IP from being blacklisted.",
    "Enforce strict egress firewall rules blocking outbound SMTP traffic (TCP 25) from all endpoints, forcing traffic through authorized mail relays.",
    "Utilize specialized anti-rootkit scanners or live memory forensics to identify and remove the hidden Cutwail drivers and injected processes.",
    "Assume total endpoint compromise; perform a clean OS rebuild, as Cutwail's rootkit capabilities make manual remediation extremely unreliable."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; being blacklisted will cause all legitimate corporate emails to be blocked globally.",
    "Avoid relying on standard, user-mode antivirus scans; the rootkit component actively hides the malware from the operating system."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2007,
  "lineage": {
    "derived_from": [],
    "variants": [
      "pushdo rootkit downloader",
      "cutwail modular spam engine",
      "cutwail dga/ssl generation (2012-2015)"
    ]
  },
  "attribution": [
    {
      "actor": "Russian Cybercrime Syndicate / 2010 Global Infrastructure Takedown",
      "confidence": "high",
      "basis": "Operated by a sophisticated Russian-speaking cybercrime enterprise. Disrupted in August 2010 via multinational server seizures coordinated by security researchers and upstream ISPs, followed by extensive sinkholing of Pushdo DGA domains.",
      "source": "https://attack.mitre.org/software/S0029/"
    }
  ],
  "exploited_cves": [
    "CVE-2010-0188",
    "CVE-2012-0158"
  ],
  "c2_profile": {
    "protocols": [
      "Encrypted TCP",
      "HTTP",
      "Direct Outbound SMTP",
      "DGA Fallback"
    ],
    "ports": [
      80,
      443,
      8080,
      25
    ],
    "infrastructure": "Decentralized command servers with domain generation algorithms (DGA) utilizing decoy HTTP requests directed at major web properties (e.g., Google, Yahoo, NASA) to mask authentic C2 traffic from network monitoring."
  },
  "iocs": {
    "file_hashes": [
      "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5",
      "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d"
    ],
    "delivery": [
      "Phishing campaigns with malicious attachments exploiting Adobe Reader (CVE-2010-0188) and Office (CVE-2012-0158)",
      "Drive-by downloads from compromised websites hosting exploit kits",
      "Infection via secondary downloaders like Andromeda and Upatre"
    ],
    "persistence": [
      "Creation of hidden Windows kernel drivers (.sys) in %SYSTEM32%\\drivers",
      "Service creation and code injection into explorer.exe or svchost.exe"
    ]
  },
  "sources": [
    {
      "name": "MITRE ATT&CK - Pushdo / Cutwail (S0029)",
      "url": "https://attack.mitre.org/software/S0029/"
    },
    {
      "name": "CISA Alert - Threat Actor Abuse of Cutwail Botnet",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    },
    {
      "name": "NIST NVD - CVE-2010-0188",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0188"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}