Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, to deploy cryptocurrency miners and reverse proxy backdoor software on affected systems. The exploitation began just one day after a public proof-of-concept (PoC) was released by a researcher known as boredhackerblog. The attack chain involves chaining four distinct vulnerabilities together to achieve code execution and persistence. The deployment of crypto miners indicates financial motivation, while the Linux proxy backdoor suggests the attackers may also be building infrastructure for further malicious activity. The rapid exploitation following PoC release underscores the urgency for Plex Media Server users to apply patches immediately. This campaign highlights the ongoing risk posed by media server software exposed to the internet.