New ShadowRay attacks convert Ray clusters into crypto miners
Source Reddit InfoSec News
Description
ShadowRay attacks target Ray clusters by compromising them to deploy unauthorized cryptocurrency mining operations. These attacks exploit vulnerabilities or misconfigurations in Ray cluster environments, converting legitimate compute resources into crypto miners, which leads to resource exhaustion and degraded performance. The threat is recent and has been reported by credible sources but currently lacks known exploits in the wild. European organizations using Ray clusters for distributed computing or AI workloads are at risk of operational disruption and increased costs due to unauthorized resource usage. Mitigation requires securing cluster access, monitoring for anomalous mining activity, and applying strict resource usage policies. Countries with significant cloud and AI infrastructure adoption, such as Germany, France, and the UK, are more likely to be impacted. Given the high impact on availability and resource integrity, ease of exploitation through misconfiguration, and no need for user interaction, the threat severity is assessed as high. Defenders should prioritize immediate cluster security audits and implement continuous monitoring to detect and prevent such crypto-mining compromises.