Plex Server Exploit Chain Used To Install Monero Mining Malware

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure TL;DR: Attackers are exploiting a chain of Plex Media Server vulnerabilities to install unauthorised cryptocurrency miners and a Linux proxy backdoor on vulnerable systems. The latest cryptojacking warning comes from an unexpected direction: home and business media servers. Security researchers have observed attackers chaining multiple weaknesses in Plex Media Server to run software on machines they do not own. The technique, dubbed Plex2Shell, involves four vulnerabilities that can be combined to reach remote code execution under certain conditions. The attacks described this week installed an XMRig cryptocurrency miner alongside software functioning as a reverse proxy or backdoor. XMRig is a legitimate open-source mining tool when used with permission, but on a compromised server it can quietly consume processing power and electricity for the benefit of an attacker. That makes cryptojacking a practical security problem well beyond exchanges and cryptocurrency wallets. The vulnerabilities were reported earlier in the year and addressed in Plex Media Server version 1.43.3.10861, acco...