#cryptomining

Read Time:3 Minute, 18 Second

Attackers have moved from probing to successful compromise of vulnerable Plex Media Server installations, using a recently published exploit chain to deploy cryptocurrency-mining malware. The activity was captured against a research honeypot on October 17, providing direct evidence that exposed servers are being targeted in the wild.

The attacks center on Plex2Shell, a public proof-of-concept that links four security flaws into an unauthenticated remote-code-execution path. Once access is gained, the intruders download additional programs, including the widely abused XMRig miner. Follow-up observations also found a bandwidth-sharing proxy process, suggesting compromised systems may be monetized in more than one way.

Four flaws combine into one serious attack pathPlex2Shell is significant because it does not rely on a single mistake. The chain combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. It begins with server-side request forgery, allowing a remote attacker to make the Plex server send crafted internal requests.

Those requests can reach internal functionality, obtain owner-authorized behavior, and write a file to a location selected by the attacker. The last step abuses Plex’s handling of an unsigned codec to load attacker-controlled code. No valid user login is needed when the full chain succeeds.

The public exploit documentation identifies Plex Media Server releases before 1.43.3.10828 as vulnerable and lists 1.43.3.10861 as the corrected build. Although the technique supports both Windows and Linux, the observed attacks hit a Linux Plex deployment running in Docker. NAS users deserve particular attention because Plex has warned that some appliances require manual updates.

Honeypot records mining and proxy payloadsThe researcher first saw exploitation traffic from 45.194.92[.]222, with later attempts associated with 91.92.40[.]202 and 176.65.139[.]228. Requests reached the /player/timeline/subscribe endpoint and referenced internal Plex services through an sslip.io hostname. The traffic also used a Python urllib user agent, a detail defenders may find useful when reviewing logs.

After the test environment was allowed to communicate outbound, it retrieved files from 217.60.194[.]116. Analysis of packed and unpacked samples led to an XMRig cryptocurrency miner. The compromise therefore consumes processor resources, raises operating costs, and may degrade media-server performance even if the attacker does not immediately pursue data theft.

A later update revealed a process named myawesomeproxy and traffic tied to proxystream[.]st. Such software can resell a victim’s internet connection as a residential proxy. That creates a second risk: malicious or abusive traffic may appear to originate from the victim’s public IP address. The evidence does not yet identify the campaign operator or connect it conclusively to a named botnet.

What Plex administrators should do nowOrganizations and home users should treat any internet-accessible, unpatched Plex server as potentially exposed. Updating is the priority, but a patch alone cannot remove malware that arrived before the upgrade. Administrators should combine remediation with a focused compromise review.

Install the latest Plex Media Server release and confirm the version actually running.

Check NAS appliances and containers for images or packages that did not update automatically.

Review the Plex process tree for unfamiliar child processes, miners, proxy clients, and download tools.

Search network telemetry for the reported IP addresses, unusual DNS lookups, and sustained outbound connections.

Rebuild a compromised container from a trusted image and rotate credentials or tokens it could access.

Published packet captures can help defenders develop behavioral detections, but fixed indicators should not be the only line of defense. Attackers can rapidly replace domains, ports, filenames, and hosting infrastructure. Alerts for Plex spawning shells or download utilities, unexpected codec files, abnormal CPU usage, and new proxy processes are more durable.

The campaign is another reminder that a media server can become an attractive foothold when it is reachable from the internet. Plex users should reduce unnecessary exposure, keep deployments current, and investigate rather than merely rebooting when unexplained resource spikes appear.