IronErn440 is a threat actor exploiting Ray AI vulnerability CVE-2023-48022 to hijack GPUs for XMRig cryptomining.
Analyst brief
IronErn440 is a threat actor tracked by Oligo Security exploiting CVE-2023-48022, a missing authentication vulnerability in the Ray AI framework, as part of the ShadowRay 2.0 campaign. It targets exposed Ray clusters on port 8265, primarily compromising AI/ML research environments and organizations with GPU resources. Key TTPs include deploying multi-stage Bash/Python payloads from GitHub repositories, hijacking NVIDIA GPUs for XMRig cryptomining, worm-like lateral movement, reverse shells, and persisting via cron jobs with periodic updates. Defenders should ensure Ray dashboards are not internet-exposed, monitor for unusual GitHub repository pulls, and investigate unexpected GPU usage or cron job modifications.
IronErn440
unknown
IronErn440 is a threat actor tracked by Oligo Security for orchestrating the ShadowRay 2.0 campaign, an evolution of attacks since September 2023 exploiting CVE-2023-48022, a missing authentication flaw in the Ray AI framework's Job Submission API. The actor submits malicious jobs to exposed Ray clusters (port 8265), deploying multi-stage Bash/Python payloads via GitHub/GitLab repositories like "ironern440-group" and "thisisforwork440-ops" to propagate worm-like, hijack NVIDIA GPUs for XMRig cryptomining, pivot laterally, create reverse shells, kill competing miners, limit CPU to 60%, and persist via cron jobs pulling updates every 15 minutes. Additional capabilities include DDoS via sockstress on port 3333 (targeting mining pools), region-specific malware (e.g., China checks), LLM-generated payloads, and use of tools like interact.sh for scanning over 230,500 public Ray servers; mitigations involve firewalling, authorization, and Anyscale's port checker.