PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network
PCPJack hijacks 230 cloud servers across AWS, Google Cloud, and Azure for covert SMTP relay network.
The threat actor PCPJack has compromised 230 cloud servers across AWS, Google Cloud, and Microsoft Azure to operate a covert SMTP email relay network. Hunt.io discovered the operation after finding exposed C2 directories containing Sliver malware configurations, deployment toolkits, and exploitation scripts. The infrastructure converts compromised business servers into SMTP proxies that are verified and synced to downstream consumers every five minutes.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Amazon Web Services?
Get an email when a new story names Amazon Web Services, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonPCPJack successfully compromised 230 cloud servers across major cloud providers by exploiting weak access controls and poor security monitoring. The attackers deployed Sliver malware and created a sophisticated SMTP relay network that operated undetected, converting legitimate business servers into email proxies. The breach was only discovered when Hunt.io found exposed C2 directories, highlighting the critical importance of proper access management and continuous monitoring in cloud environments. This incident demonstrates how compromised cloud infrastructure can be weaponized for large-scale malicious operations while remaining hidden from defenders.
What helps against this
How we list vendors
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 213.136.80.73
- ip — 38.242.204.245
- domain — smtp.gmail.com
- domain — api.ipify.org
- domain — ip-api.com
- malware — PCPJack
- malware — Sliver
- malware — Chisel