Cutwail

Cutwail is a notorious malware that has been associated with various botnets, including Necurs, Andromeda, and Dridex, at different stages of their lifecycle. It has been implicated in the distribution of malicious payloads such as IcedID, Gozi, and Pushdo, often using crypters like Hexa, Forest, Snow, Lore, and Dave to obfuscate its activities. Over the past year, we have observed an increase in crypted Gozi payloads, most often distributed via the LDR4 and Cutwail botnets. Furthermore, the malware has been linked to ITG23-related attacks involving Bumblebee, IcedID, CobaltStrike, Qakbot, and Pikabot. In 2023, a correlation was noted between the Dave and Forest crypters and the Pushdo downloader, which is tied to the Cutwail botnet. This association suggests a close relationship between the actors behind these threats. The Cutwail botnet was also likely responsible for distributing a Hexa-crypted IcedID loader, according to our analysis of the distribution emails. Additionally, Cutwail's involvement in spam campaigns, particularly those related to the old Dyre crew, indicates its continued use for malevolent purposes. The Cutwail malware was highlighted in the 2014 book "Spam Nation" as one of the global malware contagions controlled by cybercriminals operating from Spamdot. Other notable botnets mentioned include Rustock, Mega-D, Festi, Waledac, and Grum. Recently, there has been a push to rebuild the Cutwail botnet, presumably in preparation for future spam runs. This evidence underscores Cutwail's persistent threat in the cybersecurity landscape.