ShadowRay 2.0 Exploits Unpatched Ray Flaw to Build Self-Spreading GPU Cryptomining Botnet
- Securityish
- Threats & Incidents
Quick Summary
Oligo Security has reported ongoing attacks exploiting a two-year-old vulnerability in the Ray AI framework, leading to the creation of a self-replicating cryptocurrency mining botnet known as ShadowRay 2.0. This campaign affects organizations using Ray, particularly those with exposed servers, raising significant cybersecurity risks due to the exploitation of unpatched vulnerabilities.
The Securityish Brief
Implications for Organizations
The ShadowRay 2.0 campaign highlights the dangers of unpatched vulnerabilities in widely used software frameworks like Ray. Organizations utilizing Ray must ensure their clusters are not exposed to the internet, as over 230,500 Ray servers are publicly accessible, creating a tempting target for cybercriminals.
Attackers are exploiting a critical authentication flaw (CVE-2023-48022) to hijack computing resources for illicit cryptocurrency mining. This not only impacts the performance of affected systems but also poses a risk of further attacks, such as denial-of-service (DDoS) attacks against competitors.
Organizations should be vigilant about monitoring their systems for unauthorized access and unusual activity. The use of legitimate orchestration features by attackers to spread malware underscores the need for robust security practices and regular audits of software configurations.
Additionally, the fact that attackers are leveraging GitHub and GitLab to distribute malware indicates a need for organizations to scrutinize third-party code and repositories. Implementing strict access controls and reviewing the integrity of external code can help mitigate risks.
Key Takeaways
- Regularly check and update the configuration of Ray clusters to prevent unauthorized internet exposure.
- Implement firewall rules to restrict access to critical services and ports.
- Utilize the Ray Open Ports Checker tool to verify that clusters are properly secured.
- Monitor for unusual activity on your systems, especially processes that may indicate cryptojacking.
- Review and restrict access to third-party repositories to prevent malware introduction.
Key Terms & Concepts
- CVE-2023-48022: This is a critical vulnerability in the Ray AI framework that allows unauthorized access and control over affected systems.
- cryptojacking: Cryptojacking refers to the unauthorized use of someone else’s computer to mine cryptocurrency.
Read the original article here: https://thehackernews.com/2025/11/shadowray-20-exploits-unpatched-ray.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
