Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Summary
Threat actors are actively exploiting a series of four vulnerabilities in Plex Media Server, known as Plex2Shell, to deploy cryptocurrency miners and install reverse proxy backdoors. This exploitation began shortly after a proof-of-concept for the vulnerabilities was released.
IFF Assessment
The exploitation of multiple vulnerabilities to install cryptocurrency miners and backdoors represents a direct threat to system security and integrity.
Severity
The CVSS score is estimated to be high due to the chaining of multiple vulnerabilities, likely allowing for remote code execution and significant impact on affected systems, enabling unauthorized access and resource hijacking for mining.
Defender Context
Defenders need to be aware of active exploitation targeting Plex Media Server and prioritize patching these identified vulnerabilities. The chained nature of the exploit suggests that a single unpatched vulnerability can lead to a full compromise, making proactive defense crucial.