Vulnerability in Ray AI Framework Exploited by Self-Replicating Botnet

The Ray AI framework, an open-source tool maintained by Anyscale for scaling Python-based AI and machine learning applications, is currently facing significant security challenges due to a critical vulnerability tracked as CVE-2023-48022. This flaw, which has a CVSS score of 9.8, allows remote, unauthenticated attackers to execute arbitrary code via the framework’s Jobs API. As of now, over 230,000 Ray servers are exposed online, a stark increase from just a few thousand when the vulnerability was first identified.

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

The ongoing exploitation of this vulnerability is part of a campaign dubbed ShadowRay 2.0, primarily executed by a threat group known as IronErn440. This group has been leveraging the flaw to hijack Ray clusters for cryptocurrency mining, data exfiltration, and launching distributed denial-of-service (DDoS) attacks. The attackers utilize AI-generated payloads to infiltrate vulnerable clusters, deploying the XMRig cryptojacker while attempting to limit its CPU usage to evade detection.

TechRadarInternet-exposed Ray clusters targeted by self-replicating botnetTwo-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

The IronErn440 group has been observed using Ray’s legitimate orchestration features to propagate their activities across compromised clusters. They deploy multi-stage Bash and Python payloads, often hosted on platforms like GitHub and GitLab, to automate the discovery of vulnerable targets. This self-propagating mechanism allows the attackers to scan for and compromise additional Ray clusters, effectively creating a botnet capable of extensive malicious activities.

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

Numerous organizations, including startups and research institutions, have fallen victim to this campaign. Attackers have accessed sensitive proprietary assets, including AI models, datasets, and cloud credentials. The compromised clusters have also been used to steal root access to MySQL databases and other critical resources, significantly impacting the operational integrity of affected organizations.

Internet-exposed Ray clusters targeted by self-replicating botnet

Anyscale has acknowledged the vulnerability but emphasized that Ray is designed to operate within strictly controlled network environments. The company previously stated that it would implement authentication mechanisms in future releases. However, the ongoing exploitation of the vulnerability has prompted renewed scrutiny and calls for immediate action to secure exposed clusters.

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

Critics argue that Anyscale's reliance on users to secure their infrastructure has contributed to the widespread exploitation of the vulnerability. The lack of built-in authentication has left many organizations vulnerable to attacks, raising concerns about the adequacy of security measures in place for widely used open-source frameworks.

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

While Oligo Security reports that the ShadowRay 2.0 campaign has been active since September 2024, there are discrepancies regarding the timeline and scale of the attacks. Some sources indicate that the exploitation of Ray clusters has been ongoing since earlier in 2023, highlighting a potential gap in awareness and response from both users and the developers of the framework.

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

• “This is DevOps for cybercrime. Attackers used GitLab as their CI/CD pipeline for malware distribution. They can A/B test techniques, roll back failed updates, and respond to defensive measures – all through version control. The commit history showed active development in real time,” — Oligo Security

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

• “Compromised Ray clusters were used to spray attack payloads to other Ray dashboards worldwide.” — Oligo Security

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

• “In several instances, the attackers also accessed proprietary company assets, including AI models, datasets, and application source code, cloud credentials, database credentials, and access to retained user data from production environments,” — Oligo Security

Internet-exposed Ray clusters targeted by self-replicating botnet

The situation surrounding the Ray AI framework underscores the critical need for robust security measures in open-source software, particularly as cyber threats continue to evolve.

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign