Plex2Shell Flaws Exploited to Deploy Crypto Miners and Linux Backdoor

Attackers are exploiting flaws in Plex2Shell to install cryptocurrency miners and a Linux proxy backdoor on compromised servers, The Hacker News reported.

The campaign targets internet-exposed systems running the affected software. Once inside, the operators deploy two payloads: a cryptominer that converts stolen compute into revenue, and a proxy backdoor that routes attacker traffic through the hijacked host.

What does the double payload reveal?

The combination points to an operation built for layered monetization. Cryptomining generates recurring income from each infected machine, while the proxy backdoor adds a second function.

Proxied hosts carry operational value beyond mining. Attackers can relay traffic through them to mask the origin of subsequent intrusions, phishing infrastructure or credential-stuffing campaigns. Each compromised server therefore serves two revenue and access streams at once.

For the owners of infected systems, the consequences register in compute costs and bandwidth, not token prices. Miners saturate CPU cycles, degrade performance and inflate hosting bills. Proxy backdoors consume outbound bandwidth and expose the host operator to abuse complaints, IP blacklisting and potential legal exposure for traffic they never authorized.

Why does the disclosure matter for infrastructure teams?

The Hacker News did not specify the number of affected systems, the identity of the attacking group or a patch timeline in the material available. The core operational guidance follows from the attack path itself: organizations running the affected Plex2Shell components should audit internet-facing instances for both indicators.

Detection requires looking for two distinct signals. Mining activity typically appears as sustained abnormal CPU load with outbound connections to mining pools. The Linux proxy backdoor instead manifests as unexplained listening services and irregular relay traffic — a footprint that routine malware scans tuned for miners alone can miss.

Remediation therefore cannot stop at removing the miner. A host cleaned of cryptomining but left with an active proxy implant remains a functioning relay for the operators, and re-infection through the original Plex2Shell entry point remains likely until the underlying flaw is patched or the service is isolated from the public internet.

The pattern fits a broader trend tracked across security reporting in recent years: attackers increasingly pair commodity cryptomining with network-layer persistence, extracting value from the same breached fleet through multiple channels before operators notice either one.

Infrastructure teams should expect follow-on disclosure naming specific patched versions, indicators of compromise or an assigned CVE identifier as vendors complete analysis. Until then, exposure management for affected Plex2Shell deployments — patching where fixes exist, network segmentation where they do not — defines the practical response window.