SANSAR Linux cryptomining toolkit uses kernel rootkit, Tor C2, and Ethereum-based backdoor
Elastic Security Labs analyzed the SANSAR Linux cryptomining malware, a sophisticated toolkit managing CPU and GPU miners via Tor with a Rust-based orchestrator. The attacker exploited an exposed Ray job agent without authentication to gain root access on Linux GPU hosts. The malware includes a kernel rootkit to hide processes/files, an NVML wrapper to falsify GPU telemetry, and a backdoor named netns that retrieves its command-and-control (C2) address from an Ethereum smart contract. SANSAR communicates over Tor, supporting interactive shell access and miner management. The use of Ethereum for C2 discovery exemplifies novel threat actor techniques complicating detection. GPU infrastructure used for AI workloads may be vulnerable to such cryptojacking, impacting operational costs and capacity.
Detalhes técnicos
The intrusion began with exploiting an exposed Ray job agent API (MITRE T1190), allowing command execution without authentication. The attacker established persistence by planting SSH keys and deploying SANSAR components under /opt/vadi_. The kernel rootkit module acpi_thermal_mgr hides mining-related processes and network sockets using function tracer hooks. The NVML wrapper intercepts GPU monitoring calls, returning falsified utilization and temperature to evade detection. The netns backdoor uses Ethereum JSON-RPC eth_call to fetch an encoded IPv4 C2 address from a smart contract, connecting directly over TCP to receive reverse shell commands without authentication.
SANSAR's Tor-based C2 channel supports miners start/stop/configuration, shell sessions, and direct TCP traffic tasks. The miner binaries include an SRBMiner-MULTI 3.6.9 GPU miner (tilki) clone. Tor connection can run in direct or bridge mode using Lyrebird pluggable transport to evade network filters. Anti-debugging techniques are implemented. The Ethereum contract address is 0x43eb291f56688c63c93e8a93c4591fc997cf6349.
Remediação
Organizations running GPU clusters, especially for AI, should restrict access to management APIs like Ray job agents, enforce authentication, monitor for kernel module anomalies and GPU telemetry inconsistencies. Detection can leverage Elastic Security's YARA rules for SANSAR and netns. Network monitoring for Tor traffic and Ethereum smart contract queries may aid detection. Regular patching and limiting exposure of public-facing services are critical.
Linha do tempo
-
SANSAR Linux cryptomining toolkit uses kernel rootkit, Tor C2, and Ethereum-based backdoor
ler a análise desta fonte ocultar
Elastic Security Labs analyzed the SANSAR Linux cryptomining malware, a sophisticated toolkit managing CPU and GPU miners via Tor with a Rust-based orchestrator. The attacker exploited an exposed Ray job agent without authentication to gain root access on Linux GPU hosts. The malware includes a kernel rootkit to hide processes/files, an NVML wrapper to falsify GPU telemetry, and a backdoor named netns that retrieves its command-and-control (C2) address from an Ethereum smart contract. SANSAR communicates over Tor, supporting interactive shell access and miner management. The use of Ethereum for C2 discovery exemplifies novel threat actor techniques complicating detection. GPU infrastructure used for AI workloads may be vulnerable to such cryptojacking, impacting operational costs and capacity.
Technical Details
The intrusion began with exploiting an exposed Ray job agent API (MITRE T1190), allowing command execution without authentication. The attacker established persistence by planting SSH keys and deploying SANSAR components under /opt/vadi_. The kernel rootkit module acpi_thermal_mgr hides mining-related processes and network sockets using function tracer hooks. The NVML wrapper intercepts GPU monitoring calls, returning falsified utilization and temperature to evade detection. The netns backdoor uses Ethereum JSON-RPC eth_call to fetch an encoded IPv4 C2 address from a smart contract, connecting directly over TCP to receive reverse shell commands without authentication.
SANSAR's Tor-based C2 channel supports miners start/stop/configuration, shell sessions, and direct TCP traffic tasks. The miner binaries include an SRBMiner-MULTI 3.6.9 GPU miner (tilki) clone. Tor connection can run in direct or bridge mode using Lyrebird pluggable transport to evade network filters. Anti-debugging techniques are implemented. The Ethereum contract address is 0x43eb291f56688c63c93e8a93c4591fc997cf6349.
Remediation
Organizations running GPU clusters, especially for AI, should restrict access to management APIs like Ray job agents, enforce authentication, monitor for kernel module anomalies and GPU telemetry inconsistencies. Detection can leverage Elastic Security's YARA rules for SANSAR and netns. Network monitoring for Tor traffic and Ethereum smart contract queries may aid detection. Regular patching and limiting exposure of public-facing services are critical.