Hello,
Whatever the script in /ray/ was, was exploitable and this is how the account was exploited and this malicious script uploaded.

Regards,
Richard F.
Network Security Administrator