{
  "Event": {
    "analysis": "1",
    "date": "2026-06-03",
    "extends_uuid": "",
    "info": "[Threat Intel] PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network",
    "protected": false,
    "publish_timestamp": "1780629665",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780629664",
    "uuid": "bdc12c3b-f677-4d66-84c8-833e2a1bfb5d",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#cf6788",
        "local": false,
        "name": "misp-galaxy:producer=\"Hunt.io\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#657ac3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"",
        "relationship_type": ""
      },
      {
        "colour": "#91649a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0fe1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#dac154",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#00f752",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#44b2c2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Chisel (ELF)\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Chisel (Windows)\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Excalibur\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570830",
        "to_ids": false,
        "type": "link",
        "uuid": "e8fc6c71-056e-427a-bb44-974569b9e50e",
        "value": "https://hunt.io/blog/pcpjack-230-cloud-servers-smtp-proxy-network-sliver-chisel"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570830",
        "to_ids": false,
        "type": "text",
        "uuid": "aa93ee1d-be2b-4d6e-8238-9dc36b0a624d",
        "value": "PCPJack operators compromised 230 cloud Linux servers across AWS, GCP, and Azure to build a covert SMTP relay network for email-based attacks. Researchers discovered exposed directories on infrastructure at 213.136.80[.]73 containing complete deployment toolkits including Chisel binaries, Python deployers, and operational state files. The campaign deployed Sliver C2 beacons and established reverse SOCKS5 tunnels on compromised hosts, testing each for SMTP relay capability. Three deployment versions showed operational evolution from 50 to 230 nodes, with verified proxies synchronized every five minutes to a downstream aggregation server. The operation targeted cloud-hosted web applications, exploiting them to gain initial access, then establishing persistence through systemd services and cron jobs disguised as system utilities. Victims included small to medium businesses across multiple regions running containerized and traditional workloads."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570830",
        "to_ids": false,
        "type": "text",
        "uuid": "0d849e83-f882-4cea-90a0-9588e185e682",
        "value": "Name: PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network\nAuthor: AlienVault\nAdversary: PCPJack\nTags: [\"cloud compromise\", \"teampcp\", \"chisel\", \"smtp relay\", \"pcpjack\", \"proxy network\", \"sliver\"]\nTgtd countries: []\nMlwr families: [\"Sliver\", \"Chisel\"]\nAttack_ids: [\"T1053.003\", \"T1190\", \"T1572\", \"T1583.003\", \"T1036.004\", \"T1049\", \"T1057\", \"T1048\", \"T1090.003\", \"T1059.004\", \"T1543.002\", \"T1564.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570830",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "b2dc90e5-d910-454b-aa1c-32416a96a3db",
        "value": "PCPJack"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570830",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "6ec1ab56-e0a6-4d28-983b-ccd5d0a8e8e2",
        "value": "CVE-2021-4034"
      },
      {
        "category": "Network activity",
        "comment": "primary C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780626547",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "da1df64a-ba4d-4877-91a6-e3e2dfab9add",
        "value": "45.225.135.54",
        "Tag": [
          {
            "colour": "#2e1557",
            "local": false,
            "name": "asn:asn=\"64107\"",
            "relationship_type": ""
          },
          {
            "colour": "#6f94e0",
            "local": false,
            "name": "asn:as-owner=\"RACK SPHERE HOSTING S.A.\"",
            "relationship_type": ""
          },
          {
            "colour": "#5a7dcf",
            "local": false,
            "name": "asn:as-country=\"PA\"",
            "relationship_type": ""
          },
          {
            "colour": "#f31b7b",
            "local": false,
            "name": "misp-galaxy:country=\"panama\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780626568",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "293cf13f-9e28-4b84-a196-bac9b9fd288d",
        "value": "203.237.119.147",
        "Tag": [
          {
            "colour": "#9cb803",
            "local": false,
            "name": "asn:asn=\"9754\"",
            "relationship_type": ""
          },
          {
            "colour": "#aa2184",
            "local": false,
            "name": "asn:as-owner=\"CSU-AS CHOSUN UNIVERSITY\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Chisel C2 server (port 9000) and staging directory (port 8444)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780626589",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "42f36e82-9860-4938-93c9-4317b880305c",
        "value": "213.136.80.73",
        "Tag": [
          {
            "colour": "#a9711e",
            "local": false,
            "name": "asn:asn=\"51167\"",
            "relationship_type": ""
          },
          {
            "colour": "#f5370c",
            "local": false,
            "name": "asn:as-owner=\"CONTABO\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Excalibur, downstream SMTP proxy consumer",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780626611",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "13eee3c9-8ca1-4f6e-9476-ce23448e56f2",
        "value": "38.242.204.245",
        "Tag": [
          {
            "colour": "#a9711e",
            "local": false,
            "name": "asn:asn=\"51167\"",
            "relationship_type": ""
          },
          {
            "colour": "#f5370c",
            "local": false,
            "name": "asn:as-owner=\"CONTABO\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 9000\r\nChisel client connection string in all deployment scripts",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780626632",
        "to_ids": true,
        "type": "url",
        "uuid": "4255e65a-0607-4771-83a2-2a1463d02380",
        "value": "http://213.136.80.73",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Adjacent infrastructure, hosts LastPass phishing domain per SentinelOne",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780626653",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1a6dee8f-08ed-40b3-92dc-9b62d0c569f8",
        "value": "38.242.245.147",
        "Tag": [
          {
            "colour": "#a9711e",
            "local": false,
            "name": "asn:asn=\"51167\"",
            "relationship_type": ""
          },
          {
            "colour": "#f5370c",
            "local": false,
            "name": "asn:as-owner=\"CONTABO\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}