ShadowRay 2.0: Active Global Campaign Hijacks Ray AI Infrastructure Into Self-Propagating Botnet

ShadowRay 2.0 is a global hacking campaign targeting the Ray AI framework. It exploits a vulnerability to hijack exposed Ray computing clusters, turning them into a self-propagating botnet. The attackers deliver payloads via GitLab and GitHub, using AI-generated code to adapt their tactics. The botnet supports multiple malicious activities including cryptojacking, DDoS attacks, and data exfiltration. The campaign uses DevOps-style infrastructure for real-time malware updates, increasing its persistence and adaptability. No specific affected versions or patch information are provided. The campaign highlights risks in AI workload security and infrastructure exposure.

• Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own FilesMalware2026-09-08
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Plex vulnerabilities being exploited in the wild to drop a cryptominerMalware2026-10-19
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits EmergeBotnet2026-10-23
• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run AttacksMalware2026-10-21