ShadowRay 2.0: attackers hijacked exposed Ray AI clusters into a botnet
What happened
Oligo Security found an active campaign exploiting a disputed, unpatched flaw in the Ray AI compute framework to take over internet-exposed clusters, using AI-generated payloads. Hijacked clusters were used for cryptomining, data and credential theft and DDoS attacks, with more than 230,000 Ray servers exposed online.
Ray is an open-source framework from Anyscale for running AI and Python workloads across many machines, used by companies including Amazon, Apple and OpenAI. Its dashboard includes a job submission interface with no login, a flaw tracked as CVE-2023-48022 that was never patched because Ray is meant to run only inside trusted, isolated networks. Oligo Security found an attacker it tracks as IronErn440 submitting jobs to internet-exposed Ray dashboards, then using Ray's own scheduling features to reach internal nodes and push the malware on to other exposed clusters, making it spread like a worm. The payloads, which Oligo said were generated with the help of AI, mined cryptocurrency on clusters with powerful GPUs while keeping usage low to avoid notice, stole data and credentials, opened remote shells and launched denial-of-service attacks. Oligo counted more than 230,000 Ray servers exposed online, up from a few thousand during the first ShadowRay campaign in 2023 and 2024.
How it happened
Leaky AI product: Unsecured AI infrastructure. Software used to run AI systems was reachable from the internet without proper protection and was exploited.
The software involved works with many AI models, so no single model maker was involved. The product was Ray, which is open source, a type of AI building block. Vulnerability IDs: CVE-2023-48022.
Impact
Data was exposed. Data involved: credentials and unknown. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 18 Nov 2025.
GitLab and GitHub took down the repositories hosting the payloads, though the attacker quickly created new accounts. Researchers advised restricting access to Ray dashboards and adding authentication, and Anyscale offers a checker for exposed ports.