Loading story…
A global cybercriminal campaign, dubbed ShadowRay 2.0, is actively exploiting a critical unpatched vulnerability (CVE-2023-48022) in the open-source Ray distributed computing framework, which is widely used for AI workloads. Attackers, tracked as IronErn440, are leveraging the Ray dashboard API to achieve unauthenticated remote code execution, allowing them to hijack exposed Ray clusters and convert them into a self-replicating botnet. This botnet is used for cryptocurrency mining, data and credential theft, and launching distributed denial-of-service (DDoS) attacks. The campaign represents a significant evolution from previous ShadowRay attacks, with new techniques and AI-generated payloads observed, and is believed to have been active since at least September 2024.
Despite the severity of the vulnerability, which carries a CVSS score of 9.8, no patch has been issued, as the original vendor, Anyscale, maintains Ray is intended for use in strictly controlled environments. The attack surface has grown dramatically, with over 200,000 Ray servers now exposed to the internet, many belonging to startups, research labs, and cloud-hosted AI environments. The attackers have demonstrated advanced evasion tactics, such as limiting CPU usage and disguising malicious processes, and have migrated their payload delivery infrastructure from GitLab to GitHub. The Ray project has since been transferred to the Linux Foundation's PyTorch Foundation, but the vulnerability remains unaddressed, leaving a large number of systems at risk of compromise and abuse for illicit cryptomining and other malicious activities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Oligo disclosed ShadowRay 2.0 as a global campaign exploiting CVE-2023-48022 against more than 230,000 internet-reachable Ray servers. The firm attributed the activity to a threat actor it tracks as IronErn440 and said the malware appears AI/LLM-generated based on code structure and comments.
After the GitLab disruption, the operators moved payload delivery to GitHub and continued the campaign. Oligo says this new wave began on November 17, 2025, and persisted despite account takedowns, indicating resilience and likely automation.
One recent wave of the campaign relied on GitLab to host or deliver payloads until the infrastructure was removed. Oligo says this GitLab-based phase ended on November 5, 2025.
During the campaign, the operator Oligo tracks as IronErn440 used interact.sh to discover exploitable Ray dashboard instances at scale. The discovered systems were then used for cryptomining, lateral movement, data theft, credential theft, and DDoS capabilities.
Attackers began actively exploiting internet-facing Ray clusters in a campaign Oligo says has been active since at least September 2024. The operation abused the unauthenticated Ray Jobs API to execute payloads, spread across nodes, and build a self-propagating botnet.
Oligo previously reported late-2023 exploitation activity against exposed Ray environments under the ShadowRay name, establishing the precursor to the later ShadowRay 2.0 campaign. This earlier activity was later described as less advanced than the 2024-2025 operation.
A critical exposure in Ray's dashboard and unauthenticated Jobs API, tracked as CVE-2023-48022, became known as enabling remote code execution on internet-exposed Ray clusters. The issue remained unfixed because Ray was intended for trusted network environments rather than public exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityonline.info
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2025-62593** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical flaw in the open-source distributed computing framework **Ray**. The vulnerability is a code injection issue that can lead to **remote code execution** through a **DNS rebinding** attack involving browsers including **Mozilla Firefox** and **Apple Safari**, with developers running Ray in development or testing environments facing the greatest exposure. CISA updated the KEV entry to reflect an earlier `dateAdded` and moved the federal remediation deadline up to **August 20, 2026**. Ray maintainers said the issue was caused by unauthenticated critical endpoints and inadequate protections against browser-based attacks, and they released a fix in **Ray 2.52.0**. Reporting tied the flaw to multiple real-world abuse cases before and after disclosure, including weaponization by the **RondoDox** DDoS botnet operators and separate exploitation of unpatched Ray instances in **ShadowRay 2.0**, a cryptocurrency-mining campaign observed by Oligo. CISA said known ransomware use is unknown and advised organizations to apply vendor mitigations and follow its remediation and forensic triage guidance.
Aug 18, 2026
Researchers disclosed a browser networking flaw dubbed **`0.0.0.0 Day`** that allows malicious websites to send HTTP requests to services bound to localhost by targeting **`0.0.0.0`**, bypassing expected browser protections on macOS and Linux. The issue affects major browsers through inconsistent handling of localhost and private network requests, enabling state-changing actions and, in some cases, **remote code execution** against local services even when attackers cannot read responses because of CORS. Apple, Google, and other browser vendors have acknowledged the problem and moved to block or restrict **`0.0.0.0`** as a destination, while Windows is largely unaffected because the operating system already blocks such traffic. The flaw was tied to active exploitation campaigns against AI and automation infrastructure, including **ShadowRay** attacks on publicly exposed **Ray** clusters via the Ray Dashboard and Jobs API, as well as attacks on **Selenium Grid** and **PyTorch/TorchServe** instances. Oligo reported hundreds to thousands of compromised Ray servers, with attackers stealing cloud and SaaS credentials, exposing private keys, establishing reverse shells, and deploying cryptominers such as **XMRig** and **NBMiner**; Wiz separately documented **SeleniumGreed**, in which exposed Selenium Grid services were abused for cryptomining. Defenders were urged to stop exposing Ray dashboards and Selenium services to the internet, add authentication and authorization layers, enforce network isolation and firewalling, and harden local services with CSRF protections, host validation, HTTPS, and browser-related private network controls.
Jul 24, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-62593, was discovered in the Ray AI compute engine, affecting developers using Ray as a development tool. The flaw is exploitable through Safari and Firefox browsers due to insufficient browser-based attack defenses, specifically relying on the `User-Agent` header for protection, which can be bypassed according to the fetch specification. Attackers can leverage DNS rebinding techniques to exploit this vulnerability if a developer visits a malicious website or is exposed to malvertising, potentially allowing remote code execution on the developer's system. The vulnerability has been addressed in Ray version 2.52.0, and users are urged to update to this version to mitigate the risk. Security researchers highlighted that the vulnerability is particularly dangerous because it targets developers in their local environments, making it possible for attackers to gain unauthorized access and control. The issue was rated as critical with a CVSS score of 9.4, underscoring the severity of the threat. The Ray project has released security advisories and patches, and organizations using Ray in development should prioritize applying the update to prevent exploitation through browser-based attacks on Safari and Firefox.
Jun 29, 2026