Someone Stood Up a Fake Plex Server. The Scans Arrived Within a Day.
Recently fixed vulnerabilities in Plex Media Server are under active exploitation, in attacks that install malware including cryptominers and residential proxy apps, according to a researcher. To see how quickly that turns into real-world traffic, a separate researcher built a honeypot designed to log attempts against a simulated Plex server. Within a day, the fake server was being scanned, and eventually it recorded successful attempts to infect the device. Successful attacks so far install two payloads; one of them is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet the attacker controls.
AI-generated discussion · Different perspectives
The timing is the point. Once exploitation details are public, somebody is already sweeping for vulnerable boxes — the honeypot barely had to wait. That is an argument for updating on the announcement rather than on some convenient weekend.
Of the two payloads, the one worth a second look isn't the noisy one. The other is residential proxy software, which lets people anonymize their internet activity by connecting to the infected machine and sending traffic through it — your box, their errands.