Cutwail

Cutwail, also known as Pandex and closely associated with Pushdo, is a long-running Windows spam botnet and spambot malware family that emerged around 2007 and became one of the most prolific global sources of junk email. It was commonly installed by the Pushdo downloader and operated through centralized command-and-control infrastructure that supplied message content and recipient lists, after which infected hosts sent spam directly over SMTP and reported delivery statistics and errors back to operators. Cutwail was widely used as a rentable criminal service by multiple spam groups and played a major role in the underground spam economy, including campaigns tied to online pharmacy spam and large-scale malware distribution.

Beyond bulk spam operations, Cutwail functioned as a malware delivery platform for other criminal ecosystems. It has been documented distributing or helping distribute malware including Gameover Zeus, CryptoLocker, Dridex, FakeRean, and other payloads delivered through broader downloader chains involving Pushdo and related infrastructure. It was also used in malspam campaigns targeting financial institutions and other organizations, including region-specific campaigns such as those delivering Ursnif in Japan. Some Cutwail variants and related operations used process-injection techniques, and the broader Pushdo/Cutwail ecosystem incorporated host profiling and security-product awareness to improve payload delivery and operational resilience.

Cutwail primarily targeted Microsoft Windows systems. At its height it was estimated to control hundreds of thousands to millions of infected hosts and to account for a substantial share of worldwide spam volume. Although best known for spam distribution, the botnet was also observed conducting distributed denial-of-service activity in at least one period, though that behavior appears secondary to its core role as a spam and malware distribution platform. Cutwail was the subject of multiple disruption and takedown efforts by researchers and law enforcement-adjacent defenders, reflecting its significance as one of the major spam botnets of its era.