GhostAction, Apex Accelerator abuse Plex and WordPress flaws to install miners

En bref

• GhostAction and Apex Accelerator are the named activity clusters.
• Plex and WordPress/Rank Math SEO PRO are in the abuse path.
• GitHub account holders are also being pursued.
• The payload observed is a cryptocurrency miner.
• No CVE IDs were supplied, so vendor advisories are the patch guide.

Two activity clusters, GhostAction and Apex Accelerator, have been linked to a campaign that combines abuse of Plex and WordPress components with attention on GitHub account holders. The WordPress angle includes Rank Math's SEO PRO plugin. The reported outcome is installation of a cryptocurrency miner, not ransomware or data theft.

The affected surface is broad: Plex installations, WordPress sites running the named SEO add-on, and GitHub accounts. For school districts and government teams, that mix matters because media servers, public-facing websites, and source-code repositories often sit in different administrative silos. A single weak entry point can give an intruder compute resources and persistence.

The intrusion pattern described is opportunistic: flaws are being weaponized, and the payload is a miner. Mining malware is quieter than disruptive ransomware, but it still consumes CPU/GPU, raises cloud bills, degrades services, and can be a foothold for later activity. The absence of CVE identifiers in the facts means defenders cannot rely on a single patch number; they need vendor guidance and exposure checks.

GitHub targeting adds supply-chain and credential risk. Account holders should assume token, SSH key, and OAuth grant review is warranted, especially where repositories feed deployment pipelines. WordPress and Plex administrators should verify plugin and server versions, remove unused add-ons, and watch for unexpected outbound connections to mining pools.

What to watch: sudden CPU spikes on Plex or web hosts, new scheduled tasks or containers, unexplained GitHub access from unfamiliar locations, and changes to Rank Math SEO PRO settings. Because severity is critical, treat confirmed miner activity as an active incident and isolate affected systems before cleanup.

À faire maintenant

1. Inventory every Plex server, WordPress site, and Rank Math SEO PRO installation; record versions and owners before patching.
2. Apply current vendor updates and mitigations for Plex, WordPress core/themes/plugins, and Rank Math SEO PRO; remove the add-on where it is not required.
3. Review GitHub accounts for unexpected OAuth apps, personal access tokens, SSH keys, and deploy keys; revoke anything unrecognized and enforce MFA.
4. Hunt for miner behavior: sustained CPU/GPU spikes, unusual child processes, new cron/systemd tasks, container drift, and outbound traffic to mining endpoints.
5. Isolate and reimage confirmed compromised hosts; rotate credentials and secrets that were present on those systems.
6. Restrict administrative access to Plex, WordPress, and GitHub; segment these services from flat internal networks and enable centralized logging.
7. Monitor vendor advisories for updated CVE details and IOCs, and brief site owners on phishing or credential theft aimed at GitHub accounts.

Source originale

Security Affairs