The recent discovery of a covert SMTP relay network, orchestrated by the threat actor PCPJack, has raised significant concerns about cloud security. This sophisticated operation involved hijacking 230 AWS, Google Cloud, and Azure servers, showcasing the evolving tactics of cybercriminals. The use of open directories on a command-and-control (C2) server, containing source code, binaries, and deployment logs, highlights the level of access gained by the attacker. The integration of Sliver, Chisel tunneling, and proxy binaries for various Linux architectures further emphasizes the complexity of the attack. The discovery of deployer scripts and beacon implants on victim machines indicates a well-structured and automated process. The SMTP quality gate, designed to filter hosts based on their email relay capability, and the batching logic for beacon processing demonstrate a strategic approach to optimizing the network's efficiency. The presence of a diagnostic script, which checks for Chisel binaries, process running, disk space, and persistence artifacts, showcases the attacker's attention to detail and their ability to maintain control over the compromised infrastructure. The use of Python scripts for tunnel enumeration and removal of failed tunnels further enhances the network's resilience. The enrichment of verified proxies with exit IP information and the syncing of proxy lists every five minutes via SCP to a downstream server indicate a potential large-scale operation. The end goal of this campaign remains unclear, but the infrastructure's operational state suggests a significant impact on cloud security. This incident serves as a stark reminder of the ongoing challenges in securing cloud environments and the need for continuous vigilance and proactive security measures.
