Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer

Gwaer@lemmy.world ⁨6⁩ ⁨hours⁩ ago

• ripcord@lemmy.world ⁨4⁩ ⁨hours⁩ ago

  How did you detect and remove it

  source

  • Gwaer@lemmy.world ⁨2⁩ ⁨hours⁩ ago

    I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.

    Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.

    source

    • ripcord@lemmy.world ⁨2⁩ ⁨hours⁩ ago

      Did you reset your Plex admin keys?

      source

      • Gwaer@lemmy.world ⁨2⁩ ⁨hours⁩ ago

        Yeah, in the logs I saw they seemed to ett my keys so I reset everything

        source