Threat intel
Hackers Exploit Plex2Shell Flaws in Plex Media Server to Deploy Crypto Miners and Linux Proxy Backdoor
Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, to install cryptocurrency miners and reverse proxy software, according to The Hacker News. The attacks reportedly began just one day after a proof-of-concept exploit was made public.
Threat actors have begun exploiting a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software on compromised systems, according to a report from The Hacker News.
The exploitation activity involves chaining four different vulnerabilities, collectively referred to as Plex2Shell. According to a researcher who goes by the online alias boredhackerblog, the attacks commenced only a day after a proof-of-concept (PoC) exploit for the flaw chain was made public. The speed of the exploitation underscores how quickly attackers move to weaponize publicly available exploit code.
The observed payloads include cryptocurrency mining software, which hijacks a server's processing power to generate digital currency for the attackers, and reverse proxy software that effectively turns an infected Linux machine into a backdoor. Such proxy tooling can allow attackers to route malicious traffic through compromised hosts, masking the origin of further attacks and expanding their infrastructure.
Media servers like Plex are attractive targets because they are often exposed to the internet for remote streaming and may run continuously with significant system resources. Once compromised, they can provide attackers with persistent access and computing power.
The supplied excerpt of the report does not include specific CVE identifiers, affected version numbers, or patch details. Plex Media Server users are advised to monitor official Plex communications for security updates and to review whether their server instances are reachable from the public internet.
Source: The Hacker News
