PCPJack is a threat actor who compromised around 230 cloud servers to create a covert SMTP relay network. The attacker’s deployment toolkit was left exposed in an open directory without authentication, enabling defenders to analyze the tools used. Key indicators of compromise include a systemd service named xsync masquerading as a legitimate system sync utility, files located at /var/tmp/.xs, and Chisel reverse SOCKS5 tunnels operating on ports 10000-14999. The activity has been documented with MITRE ATT&CK framework mappings and detection queries published publicly. There is no vendor advisory or patch information available for this threat.

The compromise of approximately 230 cloud servers allowed the attacker to establish a hidden SMTP relay network, which can be used to facilitate spam, phishing, or other malicious email activities. The exposure of the attacker’s deployment toolkit in an open directory increases the risk of replication or further exploitation by other threat actors. No direct patch or remediation is provided, so affected systems remain vulnerable to this unauthorized use.

No official patch or remediation guidance is available. Defenders should leverage the published indicators of compromise, including the xsync systemd service, files at /var/tmp/.xs, and Chisel reverse SOCKS5 tunnels on ports 10000-14999, to detect and remove this threat. Utilize the provided MITRE ATT&CK mappings and HuntSQL queries from the referenced blog post for detection and response. Monitor for unauthorized SMTP relay activity and secure exposed directories to prevent similar exposures.