The recent discovery of a covert SMTP relay network, orchestrated by the threat actor PCPJack, has raised significant concerns in the cybersecurity community. This operation, involving the hijacking of 230 cloud servers from AWS, Google Cloud, and Azure, showcases the evolving tactics employed by malicious actors. The scale and complexity of this infrastructure are particularly striking, with 230 compromised servers quietly converted into SMTP proxies, verified for mail relay capability, and synchronized with a downstream consumer every five minutes. The sheer number of servers involved highlights the potential impact on a massive scale, as these servers were located across the U.S., Europe, and Asia.
One of the most intriguing aspects of this operation is the use of open directories on a command-and-control (C2) server, which left the threat actor's infrastructure exposed. The presence of source code, compiled binaries, and deployment state logs within these directories provides valuable insights into the actor's methods and tools. The discovery of Sliver, a toolkit for integrating SMTP proxies, along with Chisel tunneling and proxy binaries for various Linux CPU architectures, further emphasizes the sophistication of the operation. The actor's ability to deploy these tools across multiple cloud providers demonstrates a high level of technical expertise and adaptability.
The use of beacons, which periodically check in with the C2 server, is another critical component of this network. Each beacon receives a SOCKS5 proxy port derived from an MD5 hash of its Sliver UUID, ensuring consistent mapping. This approach eliminates the need for a shared port registry, adding an extra layer of complexity to the network's operation. The implementation of an SMTP quality gate, which probes for outbound access to smtp.gmail[.]com:587, further underscores the actor's strategic thinking. By filtering out hosts that cannot relay email, the actor ensures that only valuable assets remain in the network.
The diagnostic script, which tasks active beacons with checking for the presence of Chisel binaries, running processes, disk space, and reachability of port 9000 on the C2, showcases a meticulous approach to maintaining the network's integrity. The actor's use of Python scripts, such as 'chisel_verifier.py', to enumerate active Chisel tunnel ports and remove failed or dropped tunnels, further highlights their commitment to maintaining a robust and efficient infrastructure.
The end goal of this operation remains unclear, but the infrastructure's scale and operationalization suggest a significant potential for malicious activities. The verified proxy list, synced every five minutes via SCP to a downstream server, indicates a well-organized and coordinated effort. The possibility of using this infrastructure for spam, phishing, or other malicious activities is a significant concern, given the actor's ability to maintain a covert and scalable network.
In conclusion, the PCPJack operation serves as a stark reminder of the evolving nature of cyber threats and the need for continuous vigilance in the cybersecurity landscape. The actor's technical prowess, adaptability, and strategic use of tools and infrastructure make this a highly concerning development. As the cybersecurity community continues to monitor and analyze such operations, it becomes increasingly important to stay ahead of the curve and develop robust defenses against these sophisticated threats.
