According to Ars Technica, attackers have used the exploit to install programs that mine cryptocurrency and proxy services that allow Internet traffic to be routed through the victim’s connection. Infected servers may also suffer from high CPU load and reduced performance.
The good news is that Plex fixed these vulnerabilities in September. The bad news is that many Plex users haven’t updated yet, leaving their setups and machines open to attack. In fact, Plex confirms that the attacks are widespread and target servers that are accessible from the Internet and have not yet been updated.
If you have Plex installed, you should absolutely check your version and update it as soon as possible. You’ll want to update to version 1.43.3 or later. If you suspect that your machine was attacked or infected, you should also run an antivirus scan and check for unknown background processes.
Plex recommends a clean reinstall if an intrusion is confirmed, as a standard update does not necessarily remove malware.
