Case shadowray-2LLMjackingWorldwide
ShadowRay 2.0 turns exposed Ray AI clusters into self-spreading mining botnet
Oligo reported attackers abusing unauthenticated Ray job APIs (CVE-2023-48022) with LLM-written payloads to hijack AI GPU clusters for cryptomining, DDoS and data theft.
HighAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Nov 18, 2025
- Location
- Worldwide
- Target
- Ray (Anyscale) AI compute clusters
- Severity
- High
- Triggered by
- IronErn440 (tracked by Oligo Security)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- CVE-2023-48022
What happened
Oligo reported attackers abusing unauthenticated Ray job APIs (CVE-2023-48022) with LLM-written payloads to hijack AI GPU clusters for cryptomining, DDoS and data theft.
Impact: Exposed Ray AI clusters hijacked for XMRig mining, DDoS and theft of credentials and data; GPU compute stolen at scale. No dollar figure reported.
Who triggered it
Actor: IronErn440 (tracked by Oligo Security)
Attribution: Attributed by Oligo Security to a cluster it tracks as IronErn440; no government attribution
Motive: Financial gain via cryptomining, plus credential theft and DDoS-for-hire
How it happened
Attack vector: Unauthenticated Ray Jobs API on internet-exposed dashboards used to submit multi-stage Bash and Python payloads, spread cluster-wide via Ray orchestration
Root cause: CVE-2023-48022 left unpatched because Anyscale treats unauthenticated job submission as a design choice; over 230,000 Ray servers exposed to the internet
Timeline
- CVE-2023-48022 (ShadowRay) disclosed; Anyscale declines to patch
- Oligo says ShadowRay 2.0 activity begins
- First wave using GitLab payload delivery is taken down
- Second wave begins using GitHub repositories
- Oligo publishes ShadowRay 2.0 findings
Response
Oligo reported the campaign and payload repositories were removed from GitLab and GitHub, though attackers quickly recreated them; Anyscale offers configuration tooling but no patch.
Current status: Ongoing
Sources (open in a new tab)
- The Register theregister.com
- BleepingComputer bleepingcomputer.com
- Dark Reading darkreading.com
Cite this case
ShadowRay 2.0 turns exposed Ray AI clusters into self-spreading mining botnet. AI Threat Watch, case shadowray-2, Nov 18, 2025. https://aithreat.io/cases/shadowray-2/
Permanent link: https://aithreat.io/cases/shadowray-2/