RondoDox ShadowRay CVE-2023-48022 Ray /api/jobs/ Exploitation

Ethan Andrews@eandrews

•updated Jun 25, 2026•0•0•3

Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.