In a sophisticated cyberattack, hackers have developed a method to disguise cryptocurrency mining on Linux servers by manipulating GPU usage indicators. This tactic involves a unique toolkit that includes a Rust-based controller named SANSAR, a kernel rootkit, and a modified NVIDIA monitoring library.
How Hackers Exploit Linux GPU Servers
The attack began when intruders accessed three Linux GPU hosts via an unprotected Ray job agent. Ray, known for its role in distributed computing and AI processes, presented an attractive target for attackers. Unlike traditional attacks that rely on deceitful software downloads, this intrusion exploited infrastructure that accepted remote computing tasks without requiring authentication.
Elastic Security Labs researchers identified these activities in November 2026, labeling them as REF3364. Their analysis revealed that the attackers employed a coordinated array of tools designed for cryptocurrency mining, process concealment, and remote shell access, far beyond a simple mining operation running undetected.
Technical Mechanisms Behind the SANSAR Malware
The malware specifically targets the NVIDIA Management Library (NVML), which is crucial for monitoring tools like nvidia-smi. By intercepting and altering data requests, the hackers present a facade of zero GPU utilization, while actual resource usage remains concealed. Additionally, temperature and power outputs are falsified to appear within normal ranges, further obfuscating the mining activity.
SANSAR can reconstruct and reinstall its wrapper from existing source files, ensuring that the compromised monitoring layer remains intact. Alongside, a kernel rootkit conceals specific processes and files, intercepting directory listings to hide malicious activities effectively.
Persistent Threats and Future Precautions
Beyond mining operations, SANSAR extends its capabilities to maintain control over affected systems. It communicates via Tor, supports interactive Bash sessions, and facilitates changes in mining configurations. Additionally, its shell setup prevents the recording of command history, complicating forensic analysis.
Elastic’s report urges system administrators to scrutinize who has the ability to submit Ray jobs and to verify the integrity of GPU monitoring libraries. A zero reading might not indicate a clean server, highlighting the need for comprehensive investigations that consider persistent access and rootkit-level concealment.
This cyberattack underscores the evolving nature of threats facing modern computing environments. By understanding the mechanisms employed by SANSAR, organizations can better defend against similar intrusions and protect their valuable computing resources.
