Suspected ransomware attacks: Bulk file reads and deletions

Plex Media Server NAS & Devices
1

Server Version#: 1.40.2.8351
Player Version# 4.128.1

Is this normal?

Synology Active Insight
Critical event:

Hostxxxx
Event detected at2024/04/11 02:04 Action advisorySign in to your host system to confirm that the file access was not malicious.

  • User: PlexMediaServer
  • Suspicious files: /volume1/PlexMediaServer/AppData/tmp/pms-f53252d6-dfc0-4cf7-8256-f15305b288f0/EasyAudioEncoder/Convert to WAV (to 8ch or less)/1a22618c-c42d-4bbe-a063-4d2a8c77be34_17605-0-8.wav, /volume1/PlexMediaServer/AppData/tmp/pms-f53252d6-dfc0-4cf7-8256-f15305b288f0/EasyAudioEncoder/Convert to WAV (to 8ch or less)/1a22618c-c42d-4bbe-a063-4d2a8c77be34_17605-0-9.wav, /volume1/PlexMediaServer/AppData/tmp/pms-f53252d6-dfc0-4cf7-8256-f15305b288f0/EasyAudioEncoder/Convert to WAV (to 8ch or less)/1a22618c-c42d-4bbe-a063-4d2a8c77be34_17605-0-10.wav, /volume1/PlexMediaServer/AppData/tmp/pms-f53252d6-dfc0-4cf7-8256-f15305b288f0/EasyAudioEncoder/Convert to WAV (to 8ch or less)/1a22618c-c42d-4bbe-a063-4d2a8c77be34_17605-0-11.wav, /volume1/PlexMediaServer/AppData/tmp/pms-f53252d6-dfc0-4cf7-8256-f15305b288f0/EasyAudioEncoder/Convert to WAV (to 8ch or less)/1a22618c-c42d-4bbe-a063-4d2a8c77be34_17605-0-12.wav
    <If providing server logs please do NOT turn on verbose logging, only debug logging should be enabled>
2

This is normal activity for Plex.

The details shown in your log snippet are the result of Plex transcoding the audio for one or more of the files in your library.

You should whitelist the /volume1/PlexMediaServer/AppData/tmp folder so this issue does not reoccur.

1 Like
3

Thank you for your assistance…

4

My thanks as well. Same problem.

5

I reinstalled Plex and the problem went away. I never saw that Plex behavior in eight years.

6

This must be new behavior, because I’ve been running PMS on Synology NASes for years and this has never been an issue.

7

Synology never tells us what they implement.

We don’t even get advance release / beta of the OS anymore

8

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.