Are unpatched Plex servers being hijacked for crypto and proxy abuse?

The short version

• Unpatched Plex Media Server installations face active wild exploitation attempts.
• Attackers install two specific malware types: cryptocurrency miners and proxy tools.
• A researcher named the exploit chain Plex2Shell after chaining four distinct flaws.

The details

According to Ars Technica, researchers have documented active exploitation of recently fixed vulnerabilities in Plex Media Server. The attacks target unpatched devices and succeed in installing malware payloads. One researcher identified a chain of four vulnerabilities that allows remote code execution on the host system. This specific exploit sequence was dubbed Plex2Shell by the discoverer.

The exploit chain operates through a series of technical steps. It begins with an unauthenticated server-side request forgery. This is followed by a loopback pivot and the theft of security tokens. Finally, the attacker delivers and executes a payload on the compromised device. The researcher stated that artificial intelligence was used heavily to develop this proof-of-concept code.

The context

Plex addressed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five issues, with one rated at a severity of 8.6 out of 10. A separate researcher built a honeypot to track exploitation attempts using the published details. Within a single day of deployment, the honeypot recorded active scanning and successful infection attempts.

The two primary payloads installed are cryptominers and residential proxy software. The miner uses the compromised device’s processing power to generate cryptocurrency for the attacker’s wallet. The proxy software allows users to anonymise their internet traffic by routing it through the infected box.

Next steps

Organisations should verify whether any internal or home networks run Plex Media Server. If the software is present, check the version against the latest security advisories from the vendor. Ensure that automatic updates are enabled where possible to reduce the window of exposure. Monitor network logs for unusual outbound connections that might indicate proxy usage or mining activity.

What defenders should look for

Teams usually detect this type of compromise by reviewing outbound traffic patterns for unexpected connections to known mining pools or proxy networks. Check system processes for high CPU utilisation without a corresponding user task. Look for new or modified scripts in the Plex installation directory that were not placed there by the vendor. Verify that security tokens are not being exfiltrated to unknown external endpoints. Containment typically involves isolating the affected host from the network to prevent further lateral movement or data exfiltration.

What to do and how to stay safe: Plex Media Server

• Audit all devices running Plex Media Server to identify unpatched versions.
• Apply the latest vendor updates as soon as they become available.
• Monitor firewall logs for unusual outbound connections to non-standard ports.
• Review process lists for unknown executables consuming significant system resources.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the name of the exploit chain targeting Plex?

The researcher named the vulnerability chain Plex2Shell.

What malware do attackers install after exploiting these flaws?

Attackers install cryptominers and residential proxy software on compromised devices.

How severe is the highest-rated vulnerability in this group?

One of the vulnerabilities carries a severity rating of 8.6 out of 10.