SANSAR (REF3364): Linux GPU cryptomining campaign uses exposed Ray job agents, kernel rootkit, NVML spoofing and Ethereum-based C2

Linha do tempo

1. gbhackers.com ↗ · pub. 13/11/2026 10:03 · coletado 13/11 12:00

   Advanced Linux Cryptomining Campaign Uses NVIDIA GPU Telemetry Manipulation and Kernel Rootkit for Stealth

   ler a análise desta fonte ocultar

   An ongoing Linux cryptomining campaign, tracked as REF3364, leverages a sophisticated toolkit that manipulates NVIDIA GPU monitoring to conceal mining activities across compromised GPU hosts. Attackers exploited an exposed Ray job agent API, which accepted unauthenticated submissions, to deploy malicious workloads. The intrusion chain includes privilege escalation to root, installation of a Rust-based orchestrator named SANSAR, and deployment of a kernel rootkit (acpi_thermal_mgr.ko) to hide mining processes, files, and sockets. The operation subverts NVIDIA's Management Library by replacing libnvidia-ml.so.1 with a wrapper that filters telemetry data, reporting zero GPU utilization while randomizing temperature and power metrics. Communication with the operators is maintained through encrypted Tor channels and Ethereum smart-contracts for controller discovery, complicating detection and remediation. This campaign highlights the risk of relying solely on GPU telemetry for host hygiene verification, as both kernel and user-space indicators are compromised concurrently.

   Technical Details

   The initial access vector was unauthenticated job submissions via the Ray distributed computing framework's job agent, which was reachable externally despite the dashboard listening only on loopback. The attackers executed commands (e.g., nvidia-smi) to probe the environment and established a Python reverse shell before escalating privileges and planting their toolkit under /opt/vadi_. The focal evasion technique is the replacement of libnvidia-ml.so.1 with a wrapper intercepting NVIDIA Management Library calls, effectively hiding GPU mining activity from tools relying on NVML. The ftrace-based rootkit installed via DKMS (acpi_thermal_mgr.ko) ensures persistent hiding of processes and kernel artifacts. SANSAR orchestrates CPU (XMRig renamed kurt) and GPU (SRBMiner-MULTI renamed tilki) miners, communicating over the Tor network utilizing the Arti Rust implementation with multiple pluggable transports (obfs4, WebTunnel). A backdoor named netns uses Ethereum smart-contract calls to retrieve the controller's IPv4 address, then initiates direct TCP connections for command-and-control.

   Remediation

   Detection efforts must include correlation of multiple indicators such as Ray job submissions, unexpected SSH keys, modifications to NVIDIA libraries, DKMS and boot image artifacts, and unusual active services. Reliance on GPU telemetry alone is insufficient given the manipulation of core monitoring components. Establishing out-of-band monitoring and integrity checks for critical libraries and kernel modules is essential for identifying such sophisticated concealment. Network monitoring should focus on Tor traffic and suspicious TCP connections possibly involving blockchain-based controller discovery.

2. elastic.co ↗ · pub. 12/11/2026 07:48 · coletado 12/11 11:01 primeiro registro

   SANSAR Linux cryptomining toolkit uses kernel rootkit, Tor C2, and Ethereum-based backdoor

   ler a análise desta fonte ocultar

   Elastic Security Labs analyzed the SANSAR Linux cryptomining malware, a sophisticated toolkit managing CPU and GPU miners via Tor with a Rust-based orchestrator. The attacker exploited an exposed Ray job agent without authentication to gain root access on Linux GPU hosts. The malware includes a kernel rootkit to hide processes/files, an NVML wrapper to falsify GPU telemetry, and a backdoor named netns that retrieves its command-and-control (C2) address from an Ethereum smart contract. SANSAR communicates over Tor, supporting interactive shell access and miner management. The use of Ethereum for C2 discovery exemplifies novel threat actor techniques complicating detection. GPU infrastructure used for AI workloads may be vulnerable to such cryptojacking, impacting operational costs and capacity.

   Technical Details

   The intrusion began with exploiting an exposed Ray job agent API (MITRE T1190), allowing command execution without authentication. The attacker established persistence by planting SSH keys and deploying SANSAR components under /opt/vadi_. The kernel rootkit module acpi_thermal_mgr hides mining-related processes and network sockets using function tracer hooks. The NVML wrapper intercepts GPU monitoring calls, returning falsified utilization and temperature to evade detection. The netns backdoor uses Ethereum JSON-RPC eth_call to fetch an encoded IPv4 C2 address from a smart contract, connecting directly over TCP to receive reverse shell commands without authentication.

   SANSAR's Tor-based C2 channel supports miners start/stop/configuration, shell sessions, and direct TCP traffic tasks. The miner binaries include an SRBMiner-MULTI 3.6.9 GPU miner (tilki) clone. Tor connection can run in direct or bridge mode using Lyrebird pluggable transport to evade network filters. Anti-debugging techniques are implemented. The Ethereum contract address is 0x43eb291f56688c63c93e8a93c4591fc997cf6349.

   Remediation

   Organizations running GPU clusters, especially for AI, should restrict access to management APIs like Ray job agents, enforce authentication, monitor for kernel module anomalies and GPU telemetry inconsistencies. Detection can leverage Elastic Security's YARA rules for SANSAR and netns. Network monitoring for Tor traffic and Ethereum smart contract queries may aid detection. Regular patching and limiting exposure of public-facing services are critical.