Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Plex Media Server users
Incident: Active exploitation of the Plex2Shell vulnerability chain to achieve unauthenticated RCE.
Impact: Full system compromise leading to unauthorized cryptocurrency mining and the establishment of a stealthy Linux proxy backdoor.
Attacker: Unidentified threat actors (potentially linked to the AISURU botnet)
Analysis: Threat actors are chaining four distinct vulnerabilities to achieve unauthenticated remote code execution (RCE) on Plex Media Server. The attack sequence involves using SSRF to steal admin tokens and then delivering a malicious ELF payload into the server’s codec directory. Once compromised, the systems are infected with XMRig miners and a Linux reverse proxy backdoor.
Recommendations: Update Plex Media Server to version 1.43.3.10861 or later immediately.; Monitor outbound network traffic for connections to the proxystream[.]st domain.; Restrict public exposure of Plex server administrative endpoints to trusted IPs.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source