Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

Threat actors are exploiting a two-year-old vulnerability in the Ray AI framework, tracked as CVE-2023-48022 with a CVSS of 9.8, to remotely execute arbitrary code via the framework’s Jobs API, unauthenticated. Maintained by Anyscale, Ray is an open‑source framework for scaling Python‑based AI and ML applications, and clusters should be secured in controlled networks as authentication is not built in.

According to Oligo, hundreds of Ray clusters were previously compromised in a data‑theft campaign dubbed ShadowRay, and now multiple threat actors are abusing Ray’s lack of authentication in a renewed campaign dubbed ShadowRay 2.0, including an actor named IronErn440 using Ray’s orchestration features to propagate cryptojacking activity.

To evade detection, attackers limit CPU usage, masquerade as legitimate processes, hide GPU usage, and deliver payloads via GitLab and later GitHub, deploying multi‑stage Python payloads and AI‑generated attack code to identify targets and take over resources for crypto‑mining and other actions. The campaign has left thousands of clusters exposed, with researchers noting over 230,000 Ray servers accessible from the web.