Executive Summary
A sophisticated and rapidly evolving cyberattack campaign is actively exploiting a chain of vulnerabilities in Plex Media Server, collectively referred to as Plex2Shell, to achieve unauthenticated remote code execution (RCE). Threat actors are leveraging these flaws to deploy both cryptocurrency miners—primarily variants of XMRig—and a stealthy Linux proxy backdoor known as myawesomeproxy. The exploitation began within 24 hours of public proof-of-concept (PoC) code release, underscoring the criticality and speed of threat actor response. This advisory provides a comprehensive technical analysis of the vulnerabilities, the tactics, techniques, and procedures (TTPs) observed, indicators of compromise (IOCs), and actionable mitigation guidance for organizations using Plex Media Server.
Threat Actor Profile
The campaign exploiting Plex2Shell does not currently have a definitive attribution to a known advanced persistent threat (APT) group. However, infrastructure analysis reveals significant overlap with the AISURU botnet, a proxyware and DDoS-for-hire operation previously flagged by security vendors such as Bitsight. The threat actors demonstrate high technical proficiency, leveraging public exploit code almost immediately after release and automating the exploitation process to maximize impact. Their primary objectives appear to be resource hijacking for illicit cryptocurrency mining and the establishment of persistent proxy infrastructure for further monetization or malicious use.
Technical Analysis of Malware/TTPs
The Plex2Shell exploit chain comprises several vulnerabilities in Plex Media Server versions prior to 1.43.3.10861. The chain enables unauthenticated attackers to escalate privileges and execute arbitrary code on the underlying host. The technical sequence is as follows:
Attackers first exploit CVE-2026-96652, an unauthenticated server-side request forgery (SSRF) in the /player/timeline endpoint, which improperly validates the "protocol" parameter. This allows the attacker to coerce the server into making internal requests. Next, CVE-2026-96654 is abused via the searchOne endpoint, where improper input neutralization permits the attacker to invoke arbitrary plugin functions and extract the admin token. With this token, CVE-2026-96655 is leveraged to perform authenticated SSRF through the /video/:/transcode/universal endpoint, enabling the attacker to fetch payloads from attacker-controlled infrastructure. Finally, CVE-2026-96656 allows external control over file names and paths in the Codecs directory, facilitating the writing and execution of malicious ELF shared objects.
The primary payloads observed are:
The XMRig-based crypto miner, typically deployed as a process named mylovelyminer, is downloaded via a shell script (x12345) from the IP address 217.60.194[.]116 and connects to the mining pool at ota.proxystream[.]st. The miner is configured to maximize CPU usage and evade basic detection by masquerading as a legitimate process.
The myawesomeproxy backdoor is a stealthy Linux proxy that, upon execution, displays a message indicating the device's internet traffic may be externally routed. This binary connects to global.relay.proxystream[.]st, integrating the compromised host into the AISURU proxyware botnet. The backdoor is designed for persistence and minimal footprint, often running as a child process of the Plex Media Server.
Observed TTPs align with the following MITRE ATT&CK techniques: Exploit Public-Facing Application (T1190), Command and Scripting Interpreter (T1059), Implant Internal Proxy (T1090.002), Cryptocurrency Mining (T1496), and Masquerading (T1036).
Exploitation in the Wild
Exploitation of Plex2Shell began on October 17, 2026, less than 24 hours after the public release of PoC code. Multiple security researchers and community reports, including those on Reddit's SecOpsDaily and technical blogs, confirm widespread scanning and exploitation of internet-exposed Plex Media Server instances. The attacks are automated, targeting all platforms supported by Plex Media Server (Linux, Windows, macOS, Docker). The rapid weaponization and deployment of both mining and proxy payloads indicate a well-resourced and organized threat operation.
Honeypot data and user reports confirm the deployment of the mylovelyminer process and the myawesomeproxy binary, with outbound connections to the aforementioned malicious domains and IP addresses. The campaign is ongoing, with new payload variants and infrastructure being observed.
Victimology and Targeting
The primary targets are organizations and individuals running outdated versions of Plex Media Server exposed to the internet. The attack surface includes home users, small businesses, and enterprises that utilize Plex for media streaming and have not applied the latest security updates. The cross-platform nature of Plex Media Server means that Linux, Windows, macOS, and Docker deployments are all at risk. There is no evidence of targeted attacks against specific sectors; rather, the campaign is opportunistic, seeking to compromise as many vulnerable instances as possible for resource hijacking and proxy network expansion.
Mitigation and Countermeasures
Immediate action is required to mitigate the risk posed by Plex2Shell. Organizations must upgrade Plex Media Server to version 1.43.3.10861 or later, which contains patches for all known vulnerabilities in the exploit chain. Administrators should audit their systems for the presence of the mylovelyminer and myawesomeproxy binaries, as well as any unusual child processes spawned by Plex Media Server. Network monitoring should be configured to detect and block outbound connections to ota.proxystream[.]st, global.relay.proxystream[.]st, and the malicious IP addresses 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222, and 217.60.194[.]116.
Security teams should review server logs for exploitation attempts on the vulnerable endpoints and monitor for command lines or process names associated with the miner and proxy backdoor. It is also recommended to implement network segmentation and restrict external access to Plex Media Server wherever possible.
For organizations with large or distributed deployments, consider leveraging automated vulnerability management and threat detection platforms to ensure timely patching and rapid identification of compromise.
References
- The Hacker News: Hackers Exploit Plex2Shell Flaws
- Reddit: SecOpsDaily thread
- VirusTotal: myawesomeproxy sample
- Bitsight: AISURU botnet analysis
- zmain.info/blog/plex2shell
- MITRE ATT&CK Framework
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help secure your organization, or for any questions regarding this advisory, please contact us at info@rescana.com.
