Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

REF3364 hid Linux GPU cryptominers behind fake 0% utilization

3 sources · 3 articlesFirst reported Updated ()1
What's new

November 13: Cyber Security News added that the NVML wrapper substitutes 36–46°C and 100–200 watts, and that Elastic published the REF3364 analysis on November 12.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

REF3364 rooted three Linux GPU hosts via an unauthenticated Ray job agent and hid miners with a rootkit and fake GPU readings.

Elastic Security Labs is tracking REF3364, a Linux cryptomining intrusion against three GPU hosts. An internet-reachable Ray job agent accepted unauthenticated jobs even though the dashboard listened only on loopback. The actor ran nvidia-smi, opened a Python reverse shell, added an SSH key, gained root by an unidentified method, and staged a toolkit under /opt/vadi_. The Rust orchestrator SANSAR (sansar-client v0.1.3) supervised XMRig 6.25.0 as kurt and SRBMiner-MULTI 3.6.9 as tilki, whose binary matches the official Linux hash. An NVML wrapper reported zero GPU use with substituted temperature and power, the acpi_thermal_mgr rootkit hid activity, SANSAR took commands over Tor, and the netns backdoor obtained a controller address from Ethereum.

Key facts
  • Activity on the first host ran October 22–25, 2026; Elastic published on November 12.
  • SANSAR is sansar-client v0.1.3 supervising XMRig 6.25.0 and SRBMiner-MULTI 3.6.9.
  • NVML wrapper reports 0% GPU use, 36–46°C, and 100–200 watts.
  • acpi_thermal_mgr.ko loads via DKMS and an initramfs image and hides processes, files, and sockets.
  • netns is a systemd service that reads a controller IPv4 from Ethereum and connects on TCP 8080.
  • How the attacker escalated from the Ray session owner to root is not identified.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026Probes of the exposed Ray job agent began · Elastic Security Labs
  2. Oct 25, 2026Python reverse shell and SSH key followed · Elastic Security Labs
  3. Nov 12, 2026Elastic Security Labs published the REF3364 analysis · Cyber Security News

What each outlet adds

beyond the shared facts
  • Elastic Security LabsMiner versions, official tilki hash match, and DKMS plus initramfs persistence.
  • GBHackersLoopback dashboard, /opt/vadi_ staging, and unidentified root escalation.
  • Cyber Security NewsFake readings of 36–46°C and 100–200 watts; Elastic publish date.
Vendors
NVIDIA
Products
RayNVMLXMRigSRBMiner-MULTI
Threat actors
REF3364
Malware
SANSARacpi_thermal_mgr.koXMRigSRBMiner-MULTInetnsacpi_thermal_mgrkurttilki
Organizations
Elastic Security Labs

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Elastic Security LabsFirst report

    SANSAR cryptominer hides Linux GPU use with a rootkit and Tor

    REF3364 used an exposed, unauthenticated Ray job agent to root three Linux GPU hosts and deploy miners plus a backdoor.

  2. · 1d ago GBHackers

    Cryptominers falsify NVIDIA GPU telemetry on compromised Linux servers

    REF3364 reached three Linux GPU hosts through an exposed, unauthenticated Ray job agent, then hid miners with a library wrapper and kernel rootkit.

  3. · 22h ago Cyber Security News

    SANSAR Linux malware hides GPU crypto mining behind fake 0% use

    Elastic says the toolkit hit three Linux GPU hosts through an unauthenticated Ray job agent and kept root shells.