PCPJack operated a large-scale compromise of cloud servers, repurposing them into a covert SMTP relay network to potentially facilitate spam or other email-based abuse. The attacker’s toolkit was inadvertently exposed on an open directory without authentication, revealing deployment methods and host indicators such as the xsync systemd service and Chisel tunnels. The threat was publicly disclosed via a Reddit post linking to a detailed Hunt.io blog analysis, which includes technical indicators and detection queries. There is no information about a specific vulnerability exploited or vendor remediation, indicating this is an operational compromise rather than a software flaw.

The compromised cloud servers were used as a hidden SMTP relay network, which can be abused for sending spam, phishing, or other malicious email campaigns. This abuse can degrade the reputation of affected cloud providers and potentially facilitate further malicious activity. The exposure of the attacker’s toolkit may aid defenders in detection and response but does not mitigate the existing compromise. There is no indication of direct data theft or destruction from the provided information.

No official patch or remediation guidance is available from the vendor or authoritative sources. Since this is an operational compromise, affected organizations should identify and isolate compromised servers using the provided indicators such as the xsync service, /var/tmp/.xs files, and Chisel tunnels on ports 10000-14999. Removing the attacker’s persistence mechanisms and conducting a thorough investigation is recommended. Monitoring for unusual SMTP relay activity is advised. Patch status is not yet confirmed — check the vendor advisory or source blog for current remediation guidance.