PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network
PCPJack used hijacked cloud servers to build a covert SMTP relay network across AWS, Google Cloud, and Azure. Hunt.io says the infrastructure was still active and syncing verified proxies every five minutes.
Intelligence analysis by GPT-5.4 Mini
Hunt.io says PCPJack turned compromised cloud servers into SMTP proxies, then organized them into a relay pipeline that checked whether each host could send mail and pushed working proxies to a downstream server. The recovered tooling suggests a mature, automated operation still running when discovered.
PCPJack turned stolen cloud computers into a chain of mail-sending helpers, like borrowing lots of post offices to send letters from behind the scenes. The helpers were checked, sorted, and sent to another server every few minutes.
Analysis
What Hunt.io found
Hunt.io says the threat actor PCPJack hijacked cloud servers tied to AWS, Google Cloud, and Microsoft Azure and converted them into SMTP proxies. The company says it found open directories on a command-and-control server that exposed source code, compiled binaries, deployment logs, scanner output, exploitation tools, and a live Sliver configuration.
How the relay network worked
According to the report, the operation used an SMTP proxy deployment toolkit integrated with Sliver, plus Chisel tunneling binaries for multiple Linux architectures. On victim hosts, the proxy binary was dropped as a hidden file and persisted under /var/tmp/.xs. Deployer scripts loaded Sliver client settings, selected beacons that had checked in recently, and assigned each beacon a SOCKS5 port derived from its UUID.
The scripts also included a quality gate that checked whether a host could reach smtp.gmail.com:587. If outbound SMTP access was not available, the host was skipped. Hunt.io says later versions removed both the SMTP check and the batching logic, suggesting the operator kept refining the pipeline.
Automation and curation
The infrastructure was not just dropping binaries. A diagnostic script checked for Chisel, running processes, disk space, reachability of port 9000 on the C2 server, and persistence artifacts such as cron or systemd entries. Hunt.io also says the C2 ran a persistent Python daemon, chisel_verifier.py, which checked tunnel ports every 60 seconds, tested new ports for SMTP capability, and removed failed tunnels from the active pool.
Verified proxies were enriched with exit IP address, country, and ASN using public lookup services, then synced every five minutes by SCP to a downstream server at 38.242.204[.]245, which was not accessible when the report was written.
What remains unclear
Hunt.io says the end goal is not confirmed. The observable outcome is a 230-node relay network, but the firm could not determine whether it was operated by one person iterating over time or by multiple actors sharing infrastructure. The likely use cases include spam or phishing, but the source stops short of confirming which one was intended.
Key points
- PCPJack hijacked cloud servers from AWS, Google Cloud, and Azure to build an SMTP relay network.
- Hunt.io found open directories on a C2 server containing code, binaries, logs, and Sliver configuration.
- The deployment scripts checked whether hosts could relay mail before keeping them in the pipeline.
- A Python daemon continually verified Chisel tunnel ports and removed failed proxies from the active pool.
- Verified proxies were enriched with location and ASN data and synced every five minutes to a downstream server.
The network could be used at scale for spam, phishing, or other email abuse, which makes blocking and attribution harder. The fact that the infrastructure was still running when found suggests the operator had time to keep expanding and improving it.
