PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network

PCPJack hijacked 230 cloud servers from AWS, Google Cloud, and Azure to build a covert SMTP relay network.

• •Compromised servers across the U.S., Europe, and Asia were converted into SMTP proxies with mail relay verification
• •The infrastructure used Sliver C2 framework, Chisel tunneling, and SOCKS5 proxies with ports derived from MD5 hashes
• •Verified proxies were enriched with geolocation data and synced every five minutes to downstream servers via SCP
• •Deployer scripts performed diagnostics on beacon persistence, Chisel processes, disk space, and C2 server connectivity

This summary was automatically generated by AI based on the original article and may not be fully accurate.