[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAkNMOMuOhOhegVoS8BBmpeY8XHLaPY_gZK_b5PaYaC8":3},{"article":4,"iocs":53,"watch_terms":79,"solutions":80,"lesson":184},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"849135f9-c05a-42dd-99fc-1d736b1813c9","PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network","pcpjack-hijacks-230-aws-google-cloud-and-azure-servers-for-covert-smtp-relay-net-b5b822","The threat actor known as PCPJack has hijacked cloud servers associated with Amazon Web Services (AWS), Google Cloud, and Microsoft Azure to create a covert SMTP email relay network. \"Compromised business servers across the U.S., Europe, and Asia were quietly converted into SMTP proxies, verified for mail relay capability, and synced to a downstream consumer every five minutes,\" Hunt.io said in","The threat actor PCPJack has compromised 230 cloud servers across AWS, Google Cloud, and Microsoft Azure to operate a covert SMTP email relay network. Hunt.io discovered the operation after finding exposed C2 directories containing Sliver malware configurations, deployment toolkits, and exploitation scripts. The infrastructure converts compromised business servers into SMTP proxies that are verified and synced to downstream consumers every five minutes.","PCPJack hijacks 230 cloud servers across AWS, Google Cloud, and Azure for covert SMTP relay network.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fpcpjack-hijacks-230-aws-google-cloud.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEibu0mX9Tusu3siXFJzPskfA1ZYZ2OdRJTegsJFkffBc9cBBPGWguTUAI3PPAaFy-WIjziA9PIrMrZNVuFVNmbFhOSPLv6mMBPvjWnR-WQGBD2fvGFTJT358yWFFTxeFSS87aQ_fj30G2VdsGlBjy2KJiby4CS-k3X9FjjpyTGxljOo373cUaZKhdBvWZ_a\u002Fs1600\u002Fcloud-emails.jpg","2026-06-05T05:34:19+00:00","2026-06-05T06:00:18.967915+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"PCPJack","threat_actor",{"name":21,"type":19},"TeamPCP",{"name":23,"type":24},"Amazon Web Services","vendor",{"name":26,"type":24},"Google Cloud",{"name":28,"type":24},"Microsoft Azure",{"name":30,"type":31},"Sliver C2","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,65,68,71,73,76],{"type":55,"value":56,"context":57},"ip","213.136.80.73","Command-and-control (C2) server with exposed open directories containing malware configs and tooling",{"type":55,"value":59,"context":60},"38.242.204.245","Downstream server receiving synced SMTP proxy lists via SCP every five minutes",{"type":62,"value":63,"context":64},"domain","smtp.gmail.com","Target SMTP service (port 587) probed for mail relay capability as part of quality gate checks",{"type":62,"value":66,"context":67},"api.ipify.org","IP enrichment service used to gather exit IP, country, and ASN data for verified proxies",{"type":62,"value":69,"context":70},"ip-api.com","IP geolocation service used for proxy enrichment with country and ASN information",{"type":36,"value":18,"context":72},"Threat actor conducting credential theft and cloud server hijacking for SMTP relay operations",{"type":36,"value":74,"context":75},"Sliver","C2 framework integrated into SMTP proxy deployment toolkit used in the campaign",{"type":36,"value":77,"context":78},"Chisel","Tunneling and proxy binary deployed across compromised Linux servers for network relay",[23,26,28],{"controls":81,"vendors":169},[82,111,140],{"slug":83,"name":84,"problem":85,"products":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":141,"name":142,"problem":143,"products":144},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[170,176,178],{"slug":171,"name":172,"logo_path":173,"roles":174},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[175],"affected",{"slug":96,"name":97,"logo_path":98,"roles":177},[175],{"slug":179,"name":180,"logo_path":181,"roles":182},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png",[183],"reported_by",{"slug":185,"title":186,"body":187,"framework_refs":188,"framework_notes":195},"pcpjack-compromises-230-cloud-servers-for-covert-smtp-relay-network","PCPJack Compromises 230 Cloud Servers for Covert SMTP Relay Network","PCPJack successfully compromised 230 cloud servers across major cloud providers by exploiting weak access controls and poor security monitoring. The attackers deployed Sliver malware and created a sophisticated SMTP relay network that operated undetected, converting legitimate business servers into email proxies. The breach was only discovered when Hunt.io found exposed C2 directories, highlighting the critical importance of proper access management and continuous monitoring in cloud environments. This incident demonstrates how compromised cloud infrastructure can be weaponized for large-scale malicious operations while remaining hidden from defenders.",[189,190,191,192,193,194],"CIS Control 3","CIS Control 6","CIS Control 8","NIST AC-2","NIST SI-4","NIST CM-2",{}]