Attacks chaining recently patched Plex Media Server flaws are running in the wild, and successful intrusions leave malware behind.
Pulled two ways, the timeline is awkward. The vendor shipped its patch batch roughly a month ago, and within about three weeks public CVE records listed five separate flaws. The worst carries a severity score of 8.6 out of ten.
A researcher then published an exploit chaining four of them into remote code execution, naming it Plex2Shell. That detail let a second researcher stand up a honeypot mimicking a vulnerable server.
From scan to infection in a day
Scanning began within a day. Before long the honeypot recorded successful attempts to infect it.
Two payloads are landing. One is a cryptominer that turns the host into a revenue source for whoever controls the wallet. The other is residential proxy software, which routes other people’s traffic through the infected machine.
The proxy is the more dangerous of the two for anyone downstream. Residential IP addresses are valuable because they look ordinary, and an attacker holding one can reach corporate VPNs from a home broadband address that raises no alarms.
Plex servers make attractive hosts. They run in homes and small offices, they sit on always-on connections, and they are frequently exposed to the internet so people can stream remotely.
The remedy is unglamorous. Anyone running the software should confirm they are on a build released after the September patches, and check for unexpected CPU load or outbound connections in the meantime.
