ShadowRay 2.0 Exploits Unpatched Ray Flaw to Build Self-Spreading GPU Cryptomining Botnet
Source Reddit InfoSec News
Description
ShadowRay 2.0 is a newly identified botnet that exploits an unpatched vulnerability in Ray, a GPU-accelerated computing framework, to propagate itself and perform unauthorized cryptomining. The botnet leverages this flaw to spread autonomously across vulnerable systems without requiring user interaction or authentication. Although no known exploits in the wild have been confirmed yet, the threat is considered high due to the potential for widespread GPU resource hijacking and the strain it can place on organizational infrastructure. European organizations using GPU-accelerated applications or services based on Ray are at risk, especially those in sectors with high GPU utilization such as research, finance, and media. Mitigation is complicated by the absence of an official patch, necessitating proactive network segmentation, monitoring for unusual GPU usage, and restricting access to vulnerable services. Countries with significant technology sectors and high adoption of GPU computing, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation, the broad impact on confidentiality, integrity, and availability, and the self-spreading nature of the botnet, the suggested severity is critical. Defenders should prioritize detection and containment measures while awaiting official patches.