SANSAR Linux malware hides GPU crypto mining behind fake 0% use
Elastic says the toolkit hit three Linux GPU hosts through an unauthenticated Ray job agent and kept root shells.
66
Malware
acpi_thermal_mgr.ko
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 13, 2026
- Last mentioned22h ago
Timeline
2 articles · newest firstCryptominers falsify NVIDIA GPU telemetry on compromised Linux servers
REF3364 reached three Linux GPU hosts through an exposed, unauthenticated Ray job agent, then hid miners with a library wrapper and kernel rootkit.
68
Appears with
- NVIDIAvendor · 2
- XMRigmalware · 2
- SANSARmalware · 2
- Elastic Security Labsorganization · 2
- SRBMiner-MULTImalware · 2
- Rayproduct · 2
- REF3364threat actor · 1
- netnsmalware · 1
- NVMLproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.