Cryptominers falsify NVIDIA GPU telemetry on compromised Linux servers
Original title: Hackers Manipulate NVIDIA GPU Monitoring to Conceal Cryptocurrency Mining on Compromised Linux Servers
REF3364 reached three Linux GPU hosts through an exposed, unauthenticated Ray job agent, then hid miners with a library wrapper and kernel rootkit.
Elastic Security Labs describes REF3364, a Linux cryptomining intrusion that abused an internet-reachable Ray job agent even though the dashboard listened only on loopback. After unauthenticated job submission, the attacker ran nvidia-smi, opened a Python reverse shell, added an SSH key, gained root, and staged a toolkit under /opt/vadi_. SANSAR, a Rust orchestrator, ran XMRig as kurt and SRBMiner-MULTI as tilki, wrapped libnvidia-ml.so.1 so utilization read zero, and loaded the acpi_thermal_mgr.ko rootkit. Command paths used Tor and a separate Ethereum-discovered TCP controller.
Unconfirmed: Elastic's findings do not identify how privilege escalation to root occurred.
- Probing appeared on October 22, 2026; a reverse shell followed on October 25.
- The NVML wrapper reports GPU use as zero and randomizes temperature and power.
- acpi_thermal_mgr.ko hides processes, files, and sockets and can reload via DKMS.
- netns finds a controller IPv4 address through Ethereum, then connects on TCP 8080.
- How the attacker escalated from the Ray session owner to root is not identified.
Impact: Root on Linux GPU hosts and concealed cryptomining
| Product | Affected |
|---|---|
| Anyscale Ray | — |
| NVIDIA Management Library (libnvidia-ml.so.1) | — |
- 1.Correlate Ray job submissions, SSH keys, NVML library changes, and DKMS or boot-image artifacts.
- 2.Do not treat zero GPU utilization alone as evidence a host is clean.
- 3.Hunt for sansar, kurt (XMRig), tilki (SRBMiner-MULTI), and acpi_thermal_mgr.ko.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.004 Unix ShellT1098.004 SSH Authorized KeysT1574.006 Dynamic Linker HijackingT1014 RootkitT1496 Resource Hijacking
- Vendors
- NVIDIA
- Products
- Ray
- Organizations
- Elastic Security Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e | pulated simultaneously. IOCs Observable Type Name Reference 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e SHA-256 sansar Miner orchestrator 96fc528ca5e7d1c2b3add5e31 |
| sha256 | 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 | 25a3e516764d5833a99657c9e SHA-256 sansar Miner orchestrator 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 SHA-256 kurt Xmrig 6.25.0 acc706afc9322a3eae1ef49049749e0a7 |
| sha256 | acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 | b126f704976c8fbeaecdbf0aa4309ad46 SHA-256 kurt Xmrig 6.25.0 acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 SHA-256 tilki SRBMiner-MULTI Note: IP addresses and domains |
From the original article
3 min read at gbhackers.com
A Linux cryptomining intrusion in which attackers falsified NVIDIA GPU telemetry, concealed mining processes with a kernel rootkit, and maintained separate command channels through Tor and Ethereum. Tracked as REF3364, the operation deployed a coordinated toolkit across three Linux GPU hosts after abusing an internet-exposed Ray job agent. Its layered concealment targets both operating-system visibility […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.