PCPJack Built a 230-Node Cloud SMTP Relay Network on Hijacked Servers

Researchers at Hunt.io uncovered a covert 230-node SMTP relay network built from compromised Linux servers hosted on AWS, Google Cloud, and Microsoft Azure after finding two unauthenticated open directories on 213.136.80[.]73. The exposed directories contained source code, binaries, deployment logs, scanners, exploitation tools, and a live Sliver configuration, revealing an active operation that used Sliver implants and Chisel tunneling to convert business servers across the U.S., Europe, and Asia into monitored SMTP-capable proxies. Deployment artifacts showed at least one completed wave in March 2026 with 230 successful uploads and executions, while verification data suggested earlier undocumented activity using different port ranges.

The recovered toolkit showed a structured workflow that established reverse SOCKS5 tunnels, persisted on Linux systems as /var/tmp/.xs or xsync, tested outbound access to smtp.gmail[.]com:587, assigned deterministic proxy ports, and synchronized verified relay nodes every five minutes via SCP to a downstream server at 38.242.204[.]245. Hunt.io said the infrastructure was likely intended for large-scale email delivery such as spam or phishing, although the final use remains unconfirmed. The campaign has been linked to PCPJack, a cloud-focused credential-theft framework previously identified by SentinelOne, but researchers said the relationship between PCPJack and TeamPCP infrastructure remains unclear and attribution is based primarily on shared infrastructure rather than definitive operator identification.