{
  "family": "pandex",
  "sample_count": 8,
  "category": "ransomware",
  "description": "Trojan:Win32/Pandex (often an alias or component of the massive **Cutwail** botnet) is a highly prevalent, persistent trojan whose primary objective is to infect endpoints, enroll them into a global botnet, and utilize their network resources to send millions of malicious spam emails (malspam). These spam campaigns are the primary distribution mechanism for other severe malware, including banking trojans (like Zeus or Emotet) and ransomware.<br><br><b>Understanding the Pandex (Cutwail) Botnet</b><br>To an end-user, a Pandex infection is largely invisible, although they may experience slowed internet speeds due to the background spam engine. For a security analyst, Pandex represents a severe compromise of network integrity. An infected endpoint actively attacks other organizations by blasting out phishing emails, which will quickly result in the corporate IP address being blacklisted by major spam databases (e.g., Spamhaus), disrupting legitimate corporate communications.<br><br><b>Execution and Spam Engine Mechanics</b><br>Pandex is typically distributed via exploit kits (`T1189`) or as a secondary payload dropped by another trojan. Upon execution, it employs sophisticated rootkit techniques to hide its presence. It injects its malicious code into legitimate system processes like `svchost.exe` or `explorer.exe` (`T1055`) to evade detection and mask its network activity. It establishes persistence via hidden Registry keys or Scheduled Tasks (`T1053.005`). Once established, it connects to a Command and Control (C2) server (`T1071.001`) to receive spam templates and target email lists. It then utilizes its own built-in SMTP engine (`T1534`) to blast thousands of spam emails directly from the infected endpoint, bypassing the corporate mail server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the blacklisting of the corporate IP address and participation in global cybercrime. The most glaring network IoC is a massive, sustained spike in outbound SMTP traffic (Port 25 or 587) originating from an endpoint that is *not* an authorized mail server, attempting to connect directly to external MX records. Host-based IoCs include EDR alerts for process injection into `svchost.exe` and anomalous DNS queries for known spam tracking domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1534",
    "T1055",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Acting as a spam engine)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hiding within svchost.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication for spam lists)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Rootkit evasion techniques)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the spam engine and prevent further damage to the corporate IP reputation.",
    "Verify your enterprise firewall is strictly blocking outbound Port 25 traffic from all endpoints except authorized Exchange/Mail servers.",
    "Use an enterprise EDR solution or specialized rootkit removal tool to locate and terminate the injected Pandex processes.",
    "Check global spam blacklists (e.g., MXToolBox, Spamhaus) to see if the corporate IP has been blacklisted, and begin the delisting process."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is 'clean' just because it isn't encrypted by ransomware; acting as a spam node is a critical security breach.",
    "Avoid relying solely on local antivirus scans; the rootkit techniques employed by Pandex/Cutwail often require a complete OS reinstall to guarantee removal."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}