RondoDox ShadowRay CVE-2023-48022 Exploitation via Ray /api/jobs/ Endpoint

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.