ShadowRay 2.0: The Unstoppable Botnet Comedy of Errors

Hot Take:

ShadowRay 2.0: Because who needs a trusted environment when you can have a cryptomining botnet? Looks like the only “Ray” of sunshine here is the light from your GPU overheating!

Key Points:

• ShadowRay 2.0 exploits an old flaw in Ray Clusters to create a self-propagating cryptomining botnet.
• IronErn440, the threat actor, uses AI-generated payloads to compromise vulnerable Ray infrastructures.
• Activities include not just cryptomining, but also data theft, credential theft, and DDoS attacks.
• The flaw, CVE-2023-48022, remains unfixed due to Ray’s design for trusted environments.
• Defense recommendations include deploying Ray in a secure environment and implementing strict firewall rules.

Ray of Light or Ray of Doom?

In a world where open-source innovation meets cyber malevolence, ShadowRay 2.0 emerges as the villainous sequel nobody asked for. This global campaign exploits an ancient flaw in Ray’s infrastructure, turning exposed clusters into unwitting participants in a cryptomining botnet. Powered by AI-generated payloads, this sinister operation doesn’t stop at mining cryptocurrency. It delves into data and credential theft and even unleashes DDoS attacks, proving once again that the internet is a place where nightmares are born.

Old Flaws Die Hard

ShadowRay 2.0 isn’t a groundbreaking horror story—it’s more like a rerun of a bad thriller. The campaign is a continuation of a previous one that exploited the same unpatched vulnerability, CVE-2023-48022. This flaw is the gift that keeps on giving, as Ray was designed to frolic in a “strictly-controlled network environment.” But with over 230,000 Ray servers suddenly available on the internet, this party has gotten way out of hand. Oligo, the vigilant researchers, reported two waves of attacks—first abusing GitLab, then moving on to GitHub. It seems the attackers can’t resist a good version control system.

AI: The Villain We Didn’t See Coming

While AI is busy trying to write the next best-selling novel, it’s moonlighting on the dark side, generating payloads for cybercriminals. Oligo’s analysis revealed LLM-generated code prancing around in attack payloads, complete with unnecessary comments and docstrings. These clever attacks leverage the infamous CVE-2023-48022, submitting jobs to Ray’s unauthenticated Jobs API, spreading their malware love across all nodes. The cryptomining module, also AI-generated, has a peculiar fondness for systems with eight cores, labeling them “very good boys.” It’s charming, really, if only it weren’t so nefarious.

It’s Not Just About the Coins

ShadowRay 2.0 isn’t just idolizing cryptocurrency; it’s on a mission to conquer the world—or at least your data. The malware opens multiple reverse shells, allowing interactive control, potential data exfiltration, and access to everything from workload environment data to proprietary AI models. It’s like a nosy neighbor peeking into your windows, only worse. The attacker also flexes their DDoS muscles with Sockstress, exploiting TCP connections like a boss. To keep things fresh, they even execute a script every 15 minutes to check for updated payloads. Talk about commitment!

Dodging the ShadowRay Bullet

In a world where CVE-2023-48022 remains as fixable as a leaky faucet with no plumber in sight, Ray users must take matters into their own hands. The golden rule: deploy Ray clusters in a secure, trusted environment. Anyscale has even published an update to help users navigate this cryptomining minefield. Firewall rules and security group policies should be tighter than a drum, and continuous monitoring should be the norm. Oligo also suggests adding authorization on the Ray Dashboard port, because unauthorized access is so last season.

While ShadowRay 2.0 may sound like the plot of a sci-fi movie gone wrong, it’s a real threat lurking in the digital shadows. So, batten down the hatches, Ray users, and may your clusters be ever vigilant!