Executive Summary
In early 2024, cybersecurity researchers discovered that threat actors had exploited a vulnerability in the open-source Ray framework to infiltrate AI infrastructure in organizations worldwide. By abusing misconfigured or vulnerable Ray clusters, attackers deployed a self-propagating botnet named ShadowRay 2.0 that hijacked compute resources for unauthorized cryptomining and exfiltrated sensitive data. The campaign demonstrated advanced lateral movement across cloud workloads, showcasing AI services as lucrative targets and exposing gaps in east-west security and segmentation policies. Impact included disrupted operations, increased cloud costs, and exposure of confidential data, impacting both cloud-native and hybrid environments.
This incident is a stark example of how attackers rapidly weaponize software flaws in emerging technologies like AI platforms. With the proliferation of open-source AI frameworks and increased integration into core business operations, misconfigurations and unpatched vulnerabilities become high-value entry points for financially motivated cybercriminals.
Why This Matters Now
With AI adoption accelerating across industries, attackers are increasingly targeting AI infrastructure for cryptomining and data theft, exploiting insecure open-source frameworks. As more organizations rely on distributed compute clusters, the urgency to secure east-west traffic, enforce zero trust segmentation, and apply cloud-native controls is critical to prevent large-scale automated attacks like ShadowRay.
Attack Path Analysis
Attackers exploited a vulnerability in the Ray framework running on exposed AI clusters to gain initial access. After compromise, they escalated privileges to control workloads and configurations. Moving laterally, the threat spread across multiple nodes and possibly clusters via east-west traffic. The botnet established encrypted command and control channels to receive instructions and deploy malicious modules. Stolen data and illicit cryptomining traffic exited via unsecured egress paths. Ultimately, the attack resulted in resource hijacking, data theft, and persistent botnet impact.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited an exposed vulnerability in the Ray AI framework to gain unauthorized access to cloud workloads.
Related CVEs
CVE-2023-48022
CVSS 9.8A critical missing authentication vulnerability in the Ray AI framework allows remote attackers to execute arbitrary code via the job submission API.
Affected Products:
Anyscale Ray – <= 2.8.0
Exploit Status:
exploited in the wildCVE-2025-62593
CVSS 9.4A critical remote code execution vulnerability in the Ray framework allows attackers to execute arbitrary code on a developer’s machine via a malicious website or advertisement, specifically targeting users of Safari and Firefox browsers.
Affected Products:
Anyscale Ray – <= 2.52.0
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation of Remote Services
Ingress Tool Transfer
Event Triggered Execution: Cloud Infrastructure
Impair Defenses: Disable or Modify Tools
Resource Hijacking
Exfiltration Over C2 Channel
Proxy
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security of Software and Systems
Control ID: 6.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Art. 9
CISA ZTMM 2.0 – Application Security Controls
Control ID: Applications – Asset Inventory & Vulnerability Management
NIS2 Directive – Technical and Organisational Measures
Control ID: Art. 21(2)(a)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
AI infrastructure compromised by Ray framework exploits enabling cryptomining botnets, requiring enhanced Kubernetes security, egress filtering, and east-west traffic monitoring capabilities.
Computer Software/Engineering
Ray framework vulnerabilities allow threat actors to hijack AI clusters for cryptocurrency mining, demanding zero trust segmentation and threat detection implementations.
Financial Services
AI-powered trading and analytics platforms face cryptomining botnet infiltration risks, necessitating encrypted traffic controls and anomaly detection for regulatory compliance protection.
Health Care / Life Sciences
Medical AI research infrastructure targeted by self-propagating botnets exploiting Ray framework, requiring HIPAA-compliant segmentation and multicloud visibility for patient data protection.
Sources
- ShadowRay 2.0 Turns AI Clusters into Crypto Botnetshttps://www.darkreading.com/cyber-risk/shadowray-20-ai-clusters-crypto-botnetsVerified
- Critical Vulnerability Found in Ray AI Frameworkhttps://www.securityweek.com/critical-vulnerability-found-in-ray-ai-framework/Verified
- Critical Unpatched Ray AI Platform Vulnerability Exploited for Cryptocurrency Mininghttps://thehackernews.com/2024/03/critical-unpatched-ray-ai-platform.htmlVerified
- Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attackhttps://advisories.gitlab.com/pkg/pypi/ray/CVE-2025-62593/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, east-west controls, egress policy, and workload-aware threat detection would have restricted initial compromise, limited propagation, and detected the unauthorized cryptomining activity. Cloud Network Security Framework enforcement at each kill chain stage constrains attacker reach and visibility while enabling rapid anomaly response.
Control: Kubernetes Security (AKF)
Mitigation: Enforces pod/namespace-level segmentation to block direct exploitation vectors.
Control: Zero Trust Segmentation
Mitigation: Limits blast radius by restricting workload privileges and communication scope.
Control: East-West Traffic Security
Mitigation: Restricts movement to only authorized service-to-service flows within and across regions.
Control: Cloud Firewall (ACF)
Mitigation: Blocks unauthorized outbound C2 connections through signature-based inspection and FQDN filtering.
Control: Egress Security & Policy Enforcement
Mitigation: Detection and prevention of unauthorized data flows and exfiltration.
Rapid detection and quarantine of anomalous cryptomining workloads.
Impact at a Glance
Affected Business Functions
- AI Model Training
- Data Processing
- Cloud Computing Services
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive AI models, proprietary algorithms, and customer data due to unauthorized access and data exfiltration.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce strict Kubernetes and workload segmentation to prevent unauthorized access to exposed AI services.
- • Implement east-west traffic controls and microsegmentation to block lateral movement between cloud workloads.
- • Deploy egress security policies and cloud firewalls to detect and stop malicious external communications.
- • Utilize inline threat detection and anomaly response tools to swiftly identify unauthorized cryptomining or exfiltration attempts.
- • Maintain comprehensive multicloud visibility and centralized policy control to rapidly respond to attacks and reduce operational risk.
