Symantec is investigating a pump and dump stock spam campaign that used the long-lived W.32 Waledac botnet to target a marijuana farming company possibly generating thousands in illegal profits.

A Symantec blog post said the Waledac began sending out a series of spam emails under different subject lines on Nov. 7, 2015 hyping the potential of the Indie Growers Association stock, which was trading at $0.08 at the time. The stock immediately began trading at significantly higher volumes with 300,000 shares trading hands helping drive the price to a high of $0.16 by Nov. 18, 2015. The share price then immediately plummeted, a classic pump and dump move.

Symantec ran this Waledac botnet in a controlled environment and found a single botnet could spit out 35,361 emails mainly pushing the pump and dump scam, but also including some general phishing attacks and scams.