ShadowRay 2.0 Turns AI Clusters into Crypto Botnets

The article discusses the emergence of ShadowRay 2.0, a cyber threat exploiting a vulnerability in the Ray framework to hijack AI infrastructure globally. Attackers, identified as IronErn440, are using this vulnerability to create a self-propagating botnet for cryptomining and data theft. The campaign has evolved in two waves, initially utilizing GitLab for command-and-control operations and later transitioning to GitHub after being removed from GitLab.

The vulnerability, CVE-2023-48022, allows unauthorized remote code execution, posing significant risks to organizations using Ray for AI workloads. Oligo Security recommends verifying system configurations and implementing best practices to mitigate exposure.