Breaches & incidents
Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners
Attackers are exploiting Plex2Shell vulnerabilities in Plex Media Server to install cryptocurrency miners and proxy software on exposed systems, Security Affairs reports. Administrators are urged to update their servers.
Attackers are actively exploiting a set of vulnerabilities known as Plex2Shell to hijack vulnerable Plex Media Server installations and turn them into cryptocurrency miners, according to a report from Security Affairs.
Plex Media Server is designed to make movies, music, and other media available across devices. However, when a server is exposed to the internet while running vulnerable software, it can become an entry point for attackers. In the campaign described by Security Affairs, threat actors are using the Plex2Shell flaws to gain access to exposed servers and install malicious payloads on them.
According to the report, the attackers deploy cryptocurrency mining software on compromised machines, hijacking their processing resources to generate digital currency for the operators. In addition to the miners, proxy software is also being installed on infected servers, allowing the compromised systems to be abused as network relays.
The campaign highlights a recurring risk with self-hosted media servers: systems that are reachable from the public internet and not kept up to date present an attractive target, since they often run continuously with significant computing resources.
Security Affairs advises administrators to update their Plex Media Server installations to the latest available version. More broadly, operators should review whether their servers need to be exposed to the internet at all and restrict access where possible to reduce the attack surface.
Source: Security Affairs
