THREAT INTELLIGENCE REPORT

PCPJack: Hijacking AWS, Azure, and Google Cloud Servers for Covert SMTP Relay Operations

Comprehensive analysis of the PCPJack campaign leveraging compromised cloud infrastructure, Sliver C2, Chisel tunneling, and automated SMTP relay validation to create a large-scale covert email relay network.

Threat Actor
PCPJack
Campaign Type
Cloud Infrastructure Abuse
Primary Objective
SMTP Relay Network
Report Date
June 2026

Executive Summary

PCPJack is a sophisticated threat actor observed compromising cloud-hosted Linux servers across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). The operation transformed compromised business infrastructure into a distributed SMTP relay network capable of supporting large-scale email operations.

Analysis revealed the use of Sliver C2 implants, Chisel tunneling binaries, automated deployment scripts, SMTP capability validation, and centralized proxy synchronization infrastructure. More than 230 compromised systems were observed participating in the campaign.

Key Finding: The threat actor maintained a continuously updated pool of verified SMTP-capable proxies synchronized every five minutes to downstream infrastructure.

Threat Overview Metrics

Threat Level

High

Compromised Hosts

230+

Target Platforms

AWS / Azure / GCP

Infrastructure

SMTP Proxy Network

C2 Framework

Sliver

Tunneling Tool

Chisel

Threat Actor Profile

Attribute Details
Threat Actor PCPJack
Motivation Unknown (Potential Spam, Phishing, Infrastructure Leasing)
Primary Targets Internet-Exposed Linux Cloud Servers
Known Infrastructure 213.136.80[.]73
Downstream Server 38.242.204[.]245
Malware Family Sliver Implant

Attack Timeline

Initial Server Compromise

Linux cloud servers are compromised and enrolled into attacker infrastructure.

Sliver Implant Deployment

Persistent Sliver beacons establish communication with command-and-control infrastructure.

Chisel Proxy Installation

Chisel binaries are deployed and configured as persistent SOCKS5 proxies.

SMTP Validation

Systems are tested for outbound SMTP connectivity using smtp.gmail.com port 587.

Proxy Synchronization

Verified SMTP relays are synchronized every five minutes to downstream infrastructure.

Technical Analysis

Sliver Command and Control Framework

The campaign leverages Sliver, an open-source adversary emulation framework frequently abused by threat actors. Active Linux beacons are identified and automatically tasked with deployment actions.

Chisel-Based Proxy Infrastructure

Each compromised host receives a Chisel binary installed as a persistent service. The proxy port is generated using an MD5 hash of the beacon UUID, ensuring consistent assignment without maintaining a centralized registry.

Detection Challenge: Legitimate cloud infrastructure combined with encrypted C2 channels can make network-based detection significantly more difficult.

Indicators of Compromise (IOCs)

Type Indicator
C2 Server 213.136.80[.]73
Downstream Server 38.242.204[.]245
File Path /var/tmp/.xs
Protocol SMTP
Framework Sliver
Tunneling Tool Chisel
Critical Alert: Organizations operating exposed Linux cloud workloads should review systems for unauthorized Sliver implants, Chisel binaries, hidden files, persistence mechanisms, and unexpected SMTP communications.

MITRE ATT&CK Mapping

Tactic Technique ID
Persistence Create or Modify System Process T1543
Command and Control Proxy T1090
Command and Control Application Layer Protocol T1071
Execution Command and Scripting Interpreter T1059
Discovery System Information Discovery T1082

Mitigation Recommendations

  1. Monitor outbound SMTP traffic from cloud workloads.
  2. Detect unauthorized Sliver beacon activity.
  3. Audit Linux persistence mechanisms.
  4. Monitor hidden executable files in /tmp and /var/tmp.
  5. Restrict outbound connections to approved destinations.
  6. Implement EDR across cloud infrastructure.
  7. Perform regular threat hunting on internet-facing assets.
Recommended Action: Enable cloud workload protection platforms and continuously monitor for proxy tunneling software, unauthorized services, and suspicious outbound email activity.

References