Lethic Malware Family: IOCs, Detection, MITRE ATT&CK, Response

Overview

Executive Summary

Lethic is a notorious, massive spambot Trojan that has been active for over a decade. It is designed to covertly hijack Windows systems and enslave them into a global botnet infrastructure. The sole purpose of the Lethic botnet is to generate and transmit staggering volumes of unsolicited spam emails, typically promoting fraudulent pharmaceuticals, "pump-and-dump" stock scams, or distributing other malware via malicious attachments.

Infection Vector and Technical Capabilities

Lethic primarily spreads through drive-by downloads via compromised websites (exploit kits) or as a secondary payload dropped by other widespread downloader Trojans. Its technical architecture is optimized for high-volume email distribution:

Botnet Command and Control: Upon execution, Lethic connects to a centralized Command and Control (C2) server to download "spam templates" (the content of the email) and a vast list of target email addresses.
Covert SMTP Engine: Lethic does not use the victim's email client (like Outlook). It contains its own built-in, lightweight SMTP engine. It silently connects directly to external mail servers on port 25 or 587 to blast out spam in the background, completely invisible to the end-user.
Persistence and Updates: It establishes persistence (typically via Registry `Run` keys) and regularly beacons back to the C2 server to download fresh spam templates, new target lists, or updated versions of its own binary to evade AV detection.

Threat Assessment

While Lethic is not typically a data-destroying threat like ransomware, it causes severe operational disruption. A Lethic infection consumes massive amounts of corporate network bandwidth. More critically, it will quickly cause the company's external IP addresses to be blacklisted globally (e.g., by Spamhaus), completely paralyzing the organization's ability to send legitimate email.

Incident Response and Remediation

Egress Filtering (Port 25): The most immediate mitigation is to enforce strict egress filtering on the corporate firewall. Block all outbound SMTP traffic (Port 25) originating from workstations. Only designated corporate mail servers should be permitted to send outbound email.
Identify the Infected Host: Review firewall logs to identify the internal IP address generating massive amounts of outbound SMTP connections to random external IPs. Isolate this host immediately.
Malware Eradication: Utilize enterprise EDR or a full anti-malware scan to identify and remove the Lethic executable and its associated persistence mechanisms.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_LETHIC {
    meta:
        description = "Detects Lethic (spam_bot)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "lethic" ascii wide nocase
        $s2 = "spambot.lethic" ascii wide nocase
        $s3 = "trojan.lethic" ascii wide nocase
        $s4 = "win32/lethic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Lethic Activity
id: 861f9dbf079dfff7b11c7b36c4b1d86d
status: experimental
description: Detects generic indicators of the lethic malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*lethic*"
            - "*spambot.lethic*"
            - "*trojan.lethic*"
            - "*win32/lethic*"
    condition: selection
level: medium

Frequently Asked Questions

What is Lethic?

Lethic is a spambot — a spam-sending botnet — that dates back to 2008. According to Malpedia, it is known for distributing low-level pharmaceutical spam from infected computers.

What does Lethic do to an infected computer?

An infected computer becomes part of the Lethic botnet and is used to relay spam email on behalf of the operators. As Malpedia notes, the spam has historically been low-level pharmaceutical advertising, sent without the owner's knowledge.

How long has Lethic been around?

Malpedia documents Lethic as dating back to 2008, making it one of the older spam botnets. It has resurfaced at various points over the years while keeping its core role as a spam relay.

Lethic

Overview

Executive Summary

Infection Vector and Technical Capabilities

Threat Assessment

Incident Response and Remediation

Known aliases

MITRE ATT&CK Techniques

Generated Detections (Boilerplate)

YARA Rule

Sigma Rule

References & External Analysis

Frequently Asked Questions

Related Families (Category: spam_bot)

Machine-readable

Ecosystem & Interactive Environments