Cryptominers falsify NVIDIA GPU telemetry on compromised Linux servers
REF3364 reached three Linux GPU hosts through an exposed, unauthenticated Ray job agent, then hid miners with a library wrapper and kernel rootkit.
68
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 12, 2026
- Last mentioned1d ago
Timeline
2 articles · newest firstSANSAR cryptominer hides Linux GPU use with a rootkit and Tor
REF3364 used an exposed, unauthenticated Ray job agent to root three Linux GPU hosts and deploy miners plus a backdoor.
58
Appears with
- Rayproduct · 2
- SANSARmalware · 2
- kurtmalware · 1
- acpi_thermal_mgr.komalware · 1
- Elastic Security Labsorganization · 1
- SRBMiner-MULTImalware · 1
- SRBMiner-MULTIproduct · 1
- XMRigproduct · 1
- NVIDIAvendor · 1
- acpi_thermal_mgrmalware · 1
- REF3364threat actor · 1
- XMRigmalware · 1
- tilkimalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.