{
  "family": "cutwail",
  "sample_count": 92,
  "category": "trojan",
  "description": "Trojan:Win32/Cutwail (often associated with the Pushdo botnet) is a historically massive, highly resilient spam botnet and trojan downloader responsible for sending billions of spam emails daily and aggressively distributing severe secondary malware payloads.<br><br><b>Understanding Cutwail</b><br>To the end-user, a Cutwail infection is largely invisible, though the system may experience severe network lag. For incident responders, Cutwail represents a massive infrastructure threat. Operating at its peak, the Pushdo/Cutwail botnet was responsible for a significant percentage of all global spam. It is highly modular; the 'Pushdo' component handles initial infection and payload delivery, while the 'Cutwail' component is the specialized spam-sending engine.<br><br><b>Execution and Evasion Strategies</b><br>Cutwail is primarily distributed via drive-by downloads from exploit kits or dropped by other malware families. Upon execution, it employs a rootkit (often leveraging a malicious driver, like `TDSS`) to hide its files, registry keys, and network connections from the operating system and legacy antivirus. It establishes a connection to a decentralized C2 infrastructure. The Cutwail engine then utilizes an integrated, highly optimized SMTP engine to blast out spam campaigns (phishing, pump-and-dump stock scams, or malspam) directly from the infected host, spoofing headers to evade basic spam filters.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive bandwidth consumption, participation in global cybercrime, and a high likelihood of the corporate IP being blacklisted. Incident responders will observe a massive, continuous spike in outbound traffic on TCP port 25, 465, or 587 originating from rootkit-hidden processes. EDR platforms frequently flag Cutwail based on 'Suspicious Rootkit Activity' or 'Anomalous SMTP Spikes'. Memory forensics is often required to detect the hidden Cutwail modules.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1014",
    "T1566.001",
    "T1055",
    "T1498",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and prevent the corporate IP from being blacklisted.",
    "Enforce strict egress firewall rules blocking outbound SMTP traffic (TCP 25) from all endpoints, forcing traffic through authorized mail relays.",
    "Utilize specialized anti-rootkit scanners or live memory forensics to identify and remove the hidden Cutwail drivers and injected processes.",
    "Assume total endpoint compromise; perform a clean OS rebuild, as Cutwail's rootkit capabilities make manual remediation extremely unreliable."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; being blacklisted will cause all legitimate corporate emails to be blocked globally.",
    "Avoid relying on standard, user-mode antivirus scans; the rootkit component actively hides the malware from the operating system."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}