Detects a Ray worker (ray/_private/workers/default_worker.py) spawning a shell, an inline Python command (python -c / python3 -c), or a discovery or download utility. Ray runs job entrypoints from that worker through a shell, so a Python reverse shell shows up as sh -c or bash -c whose command line contains python -c and the program it starts, such as /bin/sh -i. On an exposed cluster this is exploitation of the public-facing Ray jobs API (CVE-2023-48022). Ray commonly hosts LLM training, fine-tuning, and serving, so this can be an attack on that infrastructure: theft of model weights, datasets, or API and cloud tokens, tampering with a served model, or use of the GPUs for cryptomining.

Read More