Cybersecurity researchers have discovered a critical vulnerability in the Anyscale Ray AI platform that has been actively exploited by threat actors for the past seven months. This vulnerability allows attackers to hijack computing power for illicit cryptocurrency mining. Sectors such as education, cryptocurrency, and biopharma have been targeted, with thousands of servers being hacked due to insecurely deployed Ray AI frameworks.
Companies like OpenAI, Uber, and Netflix, which rely on Ray for their AI workloads, have also fallen victim to this ongoing attack campaign. The consequences of these attacks have been severe, with sensitive data exposed, AI models tampered with, network credentials compromised, and cryptocurrency miners and reverse shells installed on compromised servers.
It is crucial for organizations to immediately patch and secure their installations of the Ray AI framework to prevent further compromise and safeguard their valuable computing resources. This security alert serves as a reminder of the importance of maintaining robust cybersecurity measures to protect against evolving threats.

Collections

A critical vulnerability in the Anyscale Ray AI platform has been actively exploited by threat actors for the past seven months, allowing them to hijack computing power for illicit cryptocurrency mining. Sectors such as education, cryptocurrency, and biopharma have been targeted, with severe consequences including exposed sensitive data, tampered AI models, compromised network credentials, and installed cryptocurrency miners and reverse shells on compromised servers. Immediate patching and securing of Ray AI installations is crucial to prevent further compromise.

Ongoing Attack Campaign Exploits Critical Vulnerability in Ray AI Platform