There's already been a post about old Plex servers getting popped by Plex2Shell (miner + proxy). Mine got hit too, but it dropped a DDoS bot instead, so adding the details.
Internet kept dropping Sunday night/monday morning. Plex was being told to flood other people and maxed out our upload every time.
I was on 1.43.0. I run staged updates, get ntfy alerts for new images, and Plex was deliberately held. In May 1.43.1 broke direct play on our Samsung Frame, Plex acknowledged the bug, so I pinned VERSION= to the last good build with a weekly reminder to retest. The reminder only checked whether the Samsung bug was fixed. It never flagged that 1.43.3 was a security fix, so the hold kept me on a vulnerable version.
If you hold back any app for a bug, make sure security releases still get your attention.
FYI:
- in from 94.154.43.88 on 32400, then called back to it on 8952
- /tmp/.pxb (its own curl/wget), /tmp/.px_7c1e
- bot at /tmp/.spid (self-deletes, shows as "cron"), copy at /var/tmp/kworker + kworker.sh
- C2 176.65.149.82:48101, backup hand.genddos.st
- plain text orders like `!ATK 179 udpplain 80 <ip> 53 len=1400`
- sha256 a654ffc9ea1d3af1cb07feeefe8ee078a0faaaf60b31aa20cfbe082d6c22696c
Look for a Plex child process called "cron", junk in /tmp or /var/tmp in the container, or TranscoderH264Options in Preferences.xml that's present but empty. The hunt script at github.com/code-zm/plex2shell is worth running.
Fixed with 1.43.4, a container rebuild and blocking the IPs. Change your Plex password too, it steals the owner token.