IronErn440

IronErn440 is a threat actor tracked by Oligo Security and associated with the ShadowRay 2.0 campaign targeting internet-exposed Ray clusters globally. The actor exploits CVE-2023-48022, a critical remote code execution issue in exposed Ray dashboard infrastructure, and abuses Ray’s unauthenticated job submission APIs and orchestration features to execute multi-stage Bash and Python payloads across cluster nodes, including large GPU-rich environments. Oligo reported the activity has been active since at least September 2024 and described it as a major evolution from earlier ShadowRay exploitation, while also assessing it appears to be a different attacker or group than the 2023 ShadowRay activity. The operation is described as a self-propagating cryptojacking botnet. IronErn440 uses compromised Ray clusters for cryptocurrency mining, lateral movement to non-internet-facing and internal-network machines, data and credential theft, and DDoS attacks. Reported techniques and behaviors include at-scale discovery of exploitable Ray dashboards using interact.sh callbacks, use of Ray’s NodeAffinitySchedulingStrategy to run malware on every alive node in a cluster, deployment of XMRig to mine Monero, throttling miner resource usage to reduce detection, deceptive file paths and fake process names such as "dns-filter," persistence via cron jobs and systemd modifications, termination of rival miners, blocking of competing mining pools via /etc/hosts and iptables, opening Python reverse shells for interactive control, and use of Sockstress for DDoS activity. Oligo reported that numerous organizations were targeted, with particular emphasis on organizations operating massive clusters and expensive GPU environments. In several cases, the actor accessed proprietary assets including AI models, datasets, application source code, cloud credentials, database credentials, and retained production user data. Oligo also reported two 2025 attack waves: an initial wave using GitLab for payload delivery and updates, followed by a shift to GitHub after GitLab removed the attacker’s infrastructure on November 5. The payloads were assessed by Oligo as likely AI/LLM-generated based on code structure, comments, and error-handling patterns. Known alias in the provided content: ironern440. The activity is associated with the ShadowRay 2.0 campaign.