Threat actors have begun exploiting a chain of four vulnerabilities in Plex Media Server, tracked collectively as Plex2Shell, to deploy cryptocurrency miners and a Linux reverse proxy backdoor. The exploitation activity emerged shortly after a proof-of-concept was published publicly. The researcher boredhackerblog reported the chaining technique, though full technical details and CVE identifiers remain pending disclosure.

What should defenders do?

Plex Media Server users should apply the latest security updates and patches released by Plex. It is recommended to monitor server logs for signs of unauthorized processes, particularly cryptocurrency mining activity and reverse proxy connections. Network segmentation and principle of least privilege are advised to limit potential lateral movement.

highCyber Attacks

Hackers Exploit Plex2Shell Chain to Deploy Crypto Miners and Linux Backdoor

Four vulnerabilities in Plex Media Server chained for unauthorized cryptomining and proxy installation

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Hackers Exploit Plex2Shell Chain to Deploy Crypto Miners and Linux Backdoor

Key Takeaways

A chain of four vulnerabilities in Plex Media Server, tracked as Plex2Shell, is being actively exploited.
Exploitation leads to deployment of cryptocurrency miners and a Linux reverse proxy backdoor.
Active exploitation began after a proof-of-concept was published publicly.
The researcher boredhackerblog reported the chaining technique.

Related Security News

highMalware

Hackers Hijack AOMEI Update Servers to Spread Malware via Backup Software

Security researchers report that threat actors compromised AOMEI's update servers, exploiting a built-in promotional feature in AOMEI Backupper to distribute malware. The attackers briefly modified configuration files before restoring them to their original state to conceal the intrusion. The full scope of infections and data compromise remains under investigation.

BleepingComputerabout 2 hours ago1 min read