AI Attacking AI: Shadow Ray 2.0

Key Takeaways

Looks like AI is being used more and more to attack guess what? AI. In this example, a threat actor is leveraging a flaw in the Ray framework to hijack AI infrastructure worldwide and distribute a self-propagating crypto mining and data theft botnet. So, attackers are using AI to attack AI and use infrastructure for crypto mining. This is from Dark Reading where they talk about how Shadow Ray 2.0 turns AI clusters into cryptobotnetss. They're referencing this work from Oliggo where attackers turn AI against itself in a global campaign that hijacks AI into a self-propagating botnet. So, these security researchers have uncovered an active global hacking campaign that uses AI to attack AI. Once again, the operation dubbed Shadow Ray 2.0 O exploits a known yet distributed flaw in Ry, which is an open-source framework that powers many of today's AI systems to quietly seize control of powerful computing clusters and conscript them into a self-replicating botnet. So back on Dark Reading, we are told that once inside, the attackers have been turning compromised AI infrastructure into launch pads for largecale crypto mining, botnet expansion, and further intrusions. According to the researchers, the campaign represents an early instance of threat actors systematically abusing AI systems to attack other AI environments. The attackers which are using this name have turned Ray's legitimate orchestration features into tools for self-propagating globally cryptojacking operation spreading autonomously across Ray clusters. And again they mention the fact that what makes this campaign notable is the use of AI against AI. So AI attacking AI. So this kind of stuff has been going on for a while. But for this recent campaign attackers leveraged DevOps style infrastructure by using GitLab as a platform for updating and delivering regionaware malware. The analysis shows attackers leveraged LLM generated payloads to accelerate and adapt their methods. They also observed multiple criminal groups competing for the same CPU resources, often terminating legitimate workloads and rival crypto miners to maximize their profits. The researchers say that what's equally concerning is the campaign's operational sophistication. They limited CPU utilization to 60% to evade detection. They disguised malicious processes as legitimate services and hid CPU usage from Ray's monitoring to avoid detection while leveraging premium compute resources. AI being used to attack AI. We still have groups trying to leverage infrastructure for crypto mining. But what are your thoughts about this? Have you seen that AI is being used to attack companies more and more? Or have you seen examples like this? Please put in the comments the stories that you've seen or that you've encountered