Attackers use Plex Media Server bug chain to deploy Monero miner and Linux backdoor
Attackers are exploiting a chain of vulnerabilities in Plex Media Server to install unauthorized crypto-mining software and a Linux proxy backdoor on vulnerable systems, according to a Techub News brief citing Bitcoinist. The technique, dubbed Plex2Shell, combines four vulnerabilities that can lead to remote code execution under specific conditions. In recent attacks, compromised servers were found running XMRig, a Monero mining program, along with software that can function as a reverse proxy or backdoor. The vulnerabilities were reported earlier this year and patched in Plex Media Server version 1.43.3.10861. Exploitation attempts appeared after proof-of-concept material became public in October. The report advises server operators to verify their installed version, apply vendor updates, and inspect systems for unusual processes or network connections.
