A threat actor group identified as PCPJack has compromised cloud servers across Amazon Web Services, Google Cloud, and Microsoft Azure to construct a covert SMTP email relay network, according to research published by multiple cloud security firms. The campaign represents a growing trend of attackers weaponizing cloud infrastructure to deliver spam, phishing emails, and malware at scale while evading traditional email security controls.
How the Campaign Works
PCPJack gained access to cloud server instances through a combination of stolen credentials, misconfigured access controls, and exploitation of unpatched vulnerabilities in cloud-hosted applications. Once inside, the attackers installed lightweight SMTP relay software on compromised instances, effectively converting legitimate cloud infrastructure into a distributed email delivery platform.
The beauty of this approach from the attacker perspective is that emails originating from major cloud provider IP address ranges carry inherent reputation advantages. Many email security systems assign higher trust scores to messages coming from AWS, Azure, and Google Cloud IP blocks, making it easier for malicious emails to bypass spam filters and reach intended targets.
The relay network was designed for stealth and resilience. Individual compromised instances handled relatively low email volumes to avoid triggering abuse detection mechanisms, while the distributed architecture meant that takedown of individual nodes did not disrupt the overall operation. The attackers rotated between compromised instances to further complicate detection and attribution.
Scale of the Infrastructure
Researchers identified compromised instances across multiple cloud regions, spanning North America, Europe, and Asia-Pacific. The geographic distribution served dual purposes: it allowed the attackers to send emails that appeared to originate from regions matching their intended targets, and it provided redundancy against regional enforcement actions.
Tenable Cloud and AI Security Risk Report for 2026 highlighted that software vulnerabilities now initiate 31 percent of cloud breaches, with misconfiguration, IAM gaps, insecure APIs, and weak software supply chain controls remaining persistent threats. The PCPJack campaign exploited several of these weaknesses simultaneously, demonstrating how cloud security failures can be chained together to enable sophisticated attack operations.
Implications for Cloud Security
The campaign underscores the shared responsibility model challenges that continue to plague cloud deployments. While cloud providers secure the underlying infrastructure, customers remain responsible for securing their workloads, access controls, and application configurations. The PCPJack operation specifically targeted gaps in customer-side security, exploiting misconfigurations that the cloud providers could not prevent.
Organizations are advised to audit their cloud instances for unauthorized SMTP services, implement egress filtering to control outbound email traffic from cloud workloads, and deploy cloud security posture management tools that can identify configuration drift and policy violations. Multi-factor authentication for all cloud management interfaces and regular credential rotation remain essential preventive measures against the initial access techniques employed by PCPJack.
Cloud providers have responded by enhancing their abuse detection capabilities and working with security researchers to identify and terminate compromised instances. However, the scale of cloud infrastructure means that detecting individual compromised instances among millions of legitimate workloads remains a significant challenge.
