Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Federal agencies and users of Plex, Siemens, and SiteGuard software
Incident: Active exploitation of critical vulnerabilities in Plex Media Server, Siemens Software Center, and SiteGuard Server Edition.
Impact: Attackers can achieve unauthenticated remote code execution and deploy malicious payloads across affected systems.
Attacker: Unidentified threat actors
Analysis: Multiple high-severity vulnerabilities are being actively weaponized, ranging from command injection to DLL sideloading. The Plex2Shell chain is particularly critical as it allows unauthenticated remote code execution to deploy cryptocurrency miners and proxy malware. Additionally, the Romulus platform is being used to leverage a Siemens DLL sideloading flaw in ClickFix attacks.
Recommendations: Update Plex Media Server to version 1.43.3.10861 or later immediately.; Apply security patches for Siemens Software Center and SiteGuard Server Edition to mitigate RCE and sideloading risks.; Monitor systems for unauthorized cryptocurrency mining activity or unexpected proxy software installations.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source