Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware

Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026.

The activity follows the release of Plex2Shell, a public exploit that chains four vulnerabilities to run code without logging in. Later observations also revealed proxy software running alongside the miner.

The findings from Boredhackerblog show active exploitation of an exposed test server, rather than scanning alone. However, the available evidence does not establish how many real servers have been compromised or identify the attackers behind the activity. The researcher also warned that restrictions on outbound traffic initially prevented collection of some payloads.

How the Plex2Shell Exploit Works

Plex announced security updates on September 1, urging users to install Plex Media Server 1.43.3 and Plex Desktop 1.115.0. Its official security notice warned that NAS users might need to install updates manually. Cyber Security News previously covered the Plex security update and affected releases.

The exploit combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. According to the Plex2Shell repository, the chain starts with server-side request forgery, which tricks Plex into sending requests chosen by an attacker. It then reaches internal functions, gains access to owner-authorized requests, and writes a file to an attacker-selected location.

The final stage abuses the loading of an unsigned codec to execute code. The repository identifies versions before 1.43.3.10828 as vulnerable and lists 1.43.3.10861 as fixed. Although the exploit supports Linux and Windows targets, the reported honeypot activity involved a Linux-based Plex deployment running in Docker.

Honeypot Captures Miner and Proxy Activity

In the researcher’s report, the first exploitation attempt came from 45.194.92[.]222. Further attempts involved 91.92.40[.]202 and 176.65.139[.]228. Recorded requests targeted /player/timeline/subscribe and included references to internal Plex services, an sslip.io hostname, and the Python-urllib/3.10 user agent.

After outbound access was enabled, the researcher observed downloads from 217.60.194[.]116 involving files named docker and x. Published artifacts included packed and unpacked samples, followed by an XMRig miner. Similar misuse of XMRig has appeared in other campaigns, including attacks against exposed Redis servers.

An update also reported a process named myawesomeproxy and traffic involving proxystream[.]st. The program displayed a message about external use of the device’s internet traffic. These observations raise concerns about proxy abuse, but they do not establish who operates this Plex campaign or prove a connection to a specific botnet.

Administrators should install the latest Plex release and verify the running version, particularly on NAS systems and Docker deployments. On Linux, review the Plex process tree for unexpected child processes, suspicious downloads, and unfamiliar mining or proxy programs. The researcher recommends examining processes with ps axjf.

Defenders can use the published packet captures to develop detections. Files marked “lab” come from controlled tests, not live attacks. The repository also warns that attackers can change ports, domains, and filenames, so matching only fixed indicators will leave detection gaps.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.