TL;DR: Attackers are exploiting a chain of Plex Media Server vulnerabilities to install unauthorised cryptocurrency miners and a Linux proxy backdoor on vulnerable systems.
The latest cryptojacking warning comes from an unexpected direction: home and business media servers. Security researchers have observed attackers chaining multiple weaknesses in Plex Media Server to run software on machines they do not own.
The technique, dubbed Plex2Shell, involves four vulnerabilities that can be combined to reach remote code execution under certain conditions. The attacks described this week installed an XMRig cryptocurrency miner alongside software functioning as a reverse proxy or backdoor.
XMRig is a legitimate open-source mining tool when used with permission, but on a compromised server it can quietly consume processing power and electricity for the benefit of an attacker. That makes cryptojacking a practical security problem well beyond exchanges and cryptocurrency wallets.
The vulnerabilities were reported earlier in the year and addressed in Plex Media Server version 1.43.3.10861, according to the security reporting. Exploitation attempts appeared after public proof-of-concept material circulated in October.
Not every server running Plex is necessarily vulnerable, and details of attackers’ success rates remain unclear. The key risk is to instances running affected, unpatched software.
For operators, the sensible response is to check the installed version, apply the vendor’s updates and review systems for unexpected processes or network connections. Cryptocurrency mining malware rarely announces itself; an unusually busy server may be the first obvious clue.
Written by the News Desk and edited by Samuel Rae.