SANSAR Linux malware hides GPU crypto mining behind fake 0% use
Original title: Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage
Elastic says the toolkit hit three Linux GPU hosts through an unauthenticated Ray job agent and kept root shells.
Elastic Security Labs, tracking the activity as REF3364, says a Rust controller called SANSAR, a kernel rootkit, and a modified NVIDIA monitoring library were used on Linux GPU servers. The wrapper reports 0% GPU utilization and substitutes temperature and power readings while XMRig and SRBMiner-MULTI mine. Entry was an internet-facing Ray job agent that accepted unauthenticated jobs; the operator added an SSH key, installed the toolkit as root, and also kept Tor shells and an Ethereum-discovered TCP backdoor.
Unconfirmed: Elastic does not explain how the operator obtained root.
- Elastic published the REF3364 analysis on November 12, 2026.
- Probes began October 22; a Python reverse-shell job ran on October 25.
- The NVML wrapper shows 36–46°C and 100–200 watts instead of real load.
- SANSAR rebuilds that wrapper and hides processes, files, and sockets via a rootkit.
- A separate backdoor looks up its controller in an Ethereum contract, then connects on TCP 8080.
Impact: Crypto mining plus persistent root shells on GPU hosts
| Product | Affected |
|---|---|
| Anyscale Ray job agent | — |
- 1.Limit who can submit Ray jobs and remove unauthenticated internet-facing agents.
- 2.Check whether NVIDIA GPU monitoring libraries have been replaced.
- 3.Hunt for the published SANSAR, miner, rootkit, and backdoor hashes.
- ATT&CK
- T1496 Resource HijackingT1014 RootkitT1098.004 SSH Authorized KeysT1059.006 PythonT1090.003 Multi-hop Proxy
- Vendors
- NVIDIA
- Threat actors
- REF3364
- Organizations
- Elastic Security Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e | ype Component or role Indicator SHA-256 SANSAR orchestrator 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e SHA-256 XMRig, named kurt 96fc528ca5e7d1c2b3add5e31b8797cb1 |
| sha256 | 675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180 | 418c2b6fdf23b7f8f6b3d1b0b7f1d SHA-256 Modified NVML wrapper 675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180 SHA-256 acpi_thermal_mgr.ko rootkit 6ba1aa275e0e2826e8b48b3 |
| sha256 | 6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4 | 65eaef89270ab04ea50a180 SHA-256 acpi_thermal_mgr.ko rootkit 6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4 SHA-256 netns backdoor df8ab6fd699e6ae90e63e9696bae8f013427 |
| sha256 | 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 | 3e26d02225a3e516764d5833a99657c9e SHA-256 XMRig, named kurt 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 SHA-256 SRBMiner-MULTI, named tilki acc706afc9322a3eae1ef49 |
| sha256 | acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 | 6c8fbeaecdbf0aa4309ad46 SHA-256 SRBMiner-MULTI, named tilki acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 SHA-256 Lyrebird transport helper cc1ad7f14777a098ccc91fd4e |
| sha256 | cc1ad7f14777a098ccc91fd4e8f6143da14418c2b6fdf23b7f8f6b3d1b0b7f1d | 23895ac56dc8a289beb2fb5b7 SHA-256 Lyrebird transport helper cc1ad7f14777a098ccc91fd4e8f6143da14418c2b6fdf23b7f8f6b3d1b0b7f1d SHA-256 Modified NVML wrapper 675c24728f87f7aa0fa07527027c9 |
| sha256 | df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194 | 39ca56cbdc41f429e539a45f8532b084d7a4 SHA-256 netns backdoor df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194 Onion endpoint SANSAR controller efxisnqldelyr5ra25oqfrsut5 |
From the original article
3 min read at cybersecuritynews.com
Hackers are hiding cryptocurrency mining on Linux GPU servers by changing the readings administrators use to spot heavy workloads. The toolkit combines a Rust-based controller called SANSAR, a kernel rootkit, and a modified NVIDIA monitoring library that reports 0% GPU utilization while mining continues in the background. The intrusion reached three Linux GPU hosts through […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.