SANSAR cryptominer hides Linux GPU use with a rootkit and Tor
Original title: 0% GPU utilization: How SANSAR hides Linux cryptomining
REF3364 used an exposed, unauthenticated Ray job agent to root three Linux GPU hosts and deploy miners plus a backdoor.
Elastic Security Labs is tracking REF3364, a Linux cryptomining intrusion that pairs the Rust orchestrator SANSAR with public miners. After rooting hosts through an internet-reachable Ray job agent that accepted unauthenticated jobs, the actor installed a kernel rootkit, an NVML wrapper that falsifies GPU readings, and the netns backdoor. SANSAR takes commands over Tor; netns reads its controller address from an Ethereum smart contract. Activity on the first host ran from October 22 to October 25, 2026.
Unconfirmed: The report describes three compromised hosts and does not name a Ray CVE.
- Probes began October 22; a Python reverse shell and SSH key followed by October 25.
- SANSAR is sansar-client v0.1.3 and supervises XMRig 6.25.0 and SRBMiner-MULTI 3.6.9.
- The acpi_thermal_mgr rootkit is loaded via DKMS and an initramfs boot image.
- netns is a systemd service that fetches a controller IPv4 address from Ethereum.
- The GPU miner tilki matches the official SRBMiner-MULTI 3.6.9 Linux hash.
Impact: Root on Linux GPU hosts used for hidden cryptomining
| Product | Affected |
|---|---|
| Ray | — |
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1098.004 SSH Authorized KeysT1496 Resource HijackingT1014 RootkitT1090.003 Multi-hop Proxy
- Products
- RayXMRigSRBMiner-MULTI
- Threat actors
- REF3364
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e | discussed in this research. Observable Type Name Reference 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e SHA-256 sansar Miner orchestrator 96fc528ca5e7d1c2b3add5e31 |
| sha256 | 675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180 | b0b7f1d SHA-256 lyrebird Tor Project transport helper 0.8.1 675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180 SHA-256 libnvidia-ml.so.1 wrapper 6ba1aa275e0e2826e8b48b364 |
| sha256 | 6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4 | 9c65eaef89270ab04ea50a180 SHA-256 libnvidia-ml.so.1 wrapper 6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4 SHA-256 acpi_thermal_mgr.ko Kernel module df8ab6fd699e6ae90 |
| sha256 | 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 | 25a3e516764d5833a99657c9e SHA-256 sansar Miner orchestrator 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 SHA-256 kurt Xmrig 6.25.0 acc706afc9322a3eae1ef49049749e0a7 |
| sha256 | acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 | b126f704976c8fbeaecdbf0aa4309ad46 SHA-256 kurt Xmrig 6.25.0 acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 SHA-256 tilki SRBMiner-MULTI cc1ad7f14777a098ccc91fd4e8f614 |
| sha256 | cc1ad7f14777a098ccc91fd4e8f6143da14418c2b6fdf23b7f8f6b3d1b0b7f1d | 9f1a123895ac56dc8a289beb2fb5b7 SHA-256 tilki SRBMiner-MULTI cc1ad7f14777a098ccc91fd4e8f6143da14418c2b6fdf23b7f8f6b3d1b0b7f1d SHA-256 lyrebird Tor Project transport helper 0.8.1 675c247 |
| sha256 | df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194 | 9a45f8532b084d7a4 SHA-256 acpi_thermal_mgr.ko Kernel module df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194 SHA-256 netns backdoor |
From the original article
12 min read at elastic.co
Elastic Security Labs analyzes SANSAR, a Linux cryptomining orchestrator that manages miners over Tor, alongside a kernel rootkit, GPU monitoring hooks and a backdoor that retrieves its C2 address from Ethereum.
By Salim Bitam · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.