New SANSAR Linux Malware Campaign Disguises Crypto Mining with False GPU Utilization Data

Cybersecurity researchers have uncovered a sophisticated Linux malware operation that enables attackers to secretly mine cryptocurrency on GPU-powered servers while deceiving administrators into believing the hardware is inactive. The campaign relies on a multi-component toolkit known as SANSAR, which combines a Rust-based command-and-control framework, a Linux kernel rootkit, and a tampered NVIDIA monitoring library designed to falsify GPU performance metrics.

By manipulating the telemetry data administrators rely on to monitor server workloads, the attackers can operate resource-intensive cryptocurrency miners without raising the usual performance alarms. The discovery highlights a new evolution of cryptojacking techniques, where adversaries focus not only on hijacking computing resources but also on actively disguising the evidence of abuse.

Researchers from Elastic Security Labs documented the campaign, tracked as REF3364, in a technical analysis published on November 12, 2026. Their investigation revealed a coordinated attack framework capable of cryptocurrency mining, stealth operations, persistence, remote access, and system control, making the threat substantially more dangerous than a traditional cryptomining infection.

Attackers Exploit Exposed Ray Infrastructure

The compromise involved three Linux servers equipped with GPUs that were running Ray, an open-source distributed computing platform widely used for artificial intelligence training, machine learning workloads, and large-scale data processing.

Because GPU infrastructure is both expensive and computationally powerful, it presents an attractive target for cybercriminals seeking to generate cryptocurrency. Rather than tricking users into downloading malware, the attackers exploited an exposed Ray Job Agent that accepted remote job submissions without requiring authentication.

This allowed the threat actors to execute code directly on the targeted systems, providing an initial foothold without relying on phishing, malicious downloads, or software supply-chain compromises.

The observed activity began on October 22, 2026, when external reconnaissance probes targeted the servers. Two days later, the attackers performed GPU inventory checks to identify available hardware resources. By October 25, they had successfully submitted a Python-based reverse-shell job, granting remote command execution on the compromised systems.

Although the primary Ray dashboard was accessible only from localhost, the exposed job submission component remained reachable via the internet and failed to enforce authentication controls, effectively turning the infrastructure into an open doorway for attackers.

SANSAR Malware Manipulates GPU Monitoring Data

One of the most notable aspects of the campaign is its ability to falsify hardware monitoring information.

The attackers specifically targeted the NVIDIA Management Library (NVML), the software interface used by monitoring utilities such as nvidia-smi to report GPU performance statistics.

Instead of modifying mining software to consume fewer resources, the attackers altered the monitoring layer itself.

Their custom wrapper library intercepts communication between monitoring applications and the genuine NVIDIA libraries. When tools request performance information, the wrapper quietly forwards the request to the legitimate NVML component, retrieves the real data, and then replaces selected values before displaying them to administrators.

As a result:

• GPU utilization is falsely reported as 0%
• Temperature readings are replaced with artificial values between 36°C and 46°C
• Power consumption figures are spoofed to appear between 100 and 200 watts
• Monitoring dashboards display seemingly normal activity despite active mining operations

The deception creates a dangerous blind spot for administrators who rely on GPU metrics to identify abuse or unexpected computational workloads.

A server that appears idle may, in reality, be operating at high capacity while cryptocurrency mining proceeds unnoticed in the background.

Researchers also observed that SANSAR can rebuild and reinstall the modified monitoring component from recovered source code, enabling attackers to quickly restore the deception if security teams attempt remediation.

Kernel Rootkit Hides Evidence of Compromise

Beyond falsifying hardware statistics, the attackers deployed a Linux kernel rootkit to conceal other indicators of malicious activity.

The rootkit intercepts key system functions used by the operating system to retrieve information about running processes, files, and network connections. By manipulating these operations, the malware effectively hides selected artifacts from system administrators and security tools.

Capabilities include:

• Concealing malicious processes
• Hiding attacker-created files
• Obscuring network socket connections
• Removing entries from directory listings
• Returning errors when security tools attempt inspections

While rootkit-enabled cryptojacking campaigns are not new, the combination of kernel-level concealment and manipulated GPU telemetry represents a significant advancement in evasive mining operations.

Instead of simply hiding the mining process, the attackers hide both the software and the hardware usage it generates.

SANSAR Acts as a Mining Controller

The SANSAR framework itself does not conduct all mining operations directly. Instead, it functions as an orchestration platform responsible for managing widely available mining software.

For CPU-based cryptocurrency mining, the toolkit deploys XMRig, one of the most commonly used Monero mining platforms.

For GPU mining, it launches SRBMiner-MULTI, a mining application capable of leveraging graphics processors for increased profitability.

SANSAR automatically supplies:

• Mining pool addresses
• Wallet credentials
• Authentication information
• Mining algorithms
• Runtime configuration settings

Researchers noted that these launch mechanisms did not contain hardcoded backup wallets or fallback mining pools. Instead, the configuration appears to be dynamically delivered from attacker-controlled infrastructure.

Persistent Access Extends Beyond Cryptomining

The campaign is not limited to unauthorized cryptocurrency generation.

Following initial access, the attackers established long-term persistence by installing SSH keys, giving them the ability to reconnect even if the original access method is disabled.

After obtaining root privileges through an as-yet-undetermined mechanism, the attackers deployed the full SANSAR toolkit, compiled and installed the rootkit using Dynamic Kernel Module Support (DKMS), and configured an early-boot loader to ensure malicious components launch automatically during system startup.

Elastic's analysis did not determine exactly how privilege escalation from the Ray user account to root access was achieved.

Built-In Remote Administration Capabilities

SANSAR functions as a comprehensive post-compromise management platform rather than a simple cryptomining utility.

The malware communicates through the Tor network, helping conceal command-and-control traffic and attacker infrastructure.

Its capabilities include:

• Interactive Bash shell access
• Remote command execution
• Miner configuration management
• Output collection and forwarding
• Network traffic generation
• Operational control of deployed payloads

To reduce forensic evidence, shell sessions are configured to prevent command history from being saved locally.

These capabilities allow attackers to treat compromised servers as remotely controlled assets, creating opportunities for espionage, lateral movement, and follow-on attacks beyond cryptocurrency mining.

Ethereum-Based Backdoor Provides Additional Access

Researchers discovered a second persistence mechanism that operates independently of the primary SANSAR communication channel.

A dedicated backdoor retrieves command-and-control information from an Ethereum smart contract, enabling attackers to store infrastructure details on a decentralized blockchain platform.

After obtaining the controller address, the backdoor establishes a direct TCP connection and provides another pathway for remote shell access.

This approach complicates takedown efforts because defenders cannot simply block traditional command-and-control servers. The use of blockchain-based infrastructure adds resilience and makes attacker communications more difficult to disrupt.

Detection and Mitigation Recommendations

Elastic Security researchers emphasized that organizations operating Ray clusters and Linux GPU infrastructure should immediately review remote access controls and verify that job submission interfaces are not exposed to unauthorized users.

Key defensive actions include:

• Restrict access to Ray Job Agents using authentication and network segmentation.
• Remove unnecessary internet exposure from AI and GPU computing environments.
• Verify the integrity of NVML libraries and NVIDIA monitoring components.
• Investigate unexpected changes to GPU monitoring outputs.
• Audit SSH authorized_keys files for unauthorized additions.
• Inspect systems for DKMS-installed kernel modules that may indicate rootkit activity.
• Monitor outbound Tor connections from GPU servers.
• Examine unusual persistence mechanisms executed during system startup.
• Investigate discrepancies between actual power consumption and reported GPU utilization metrics.

Perhaps most importantly, administrators should not assume that a reported 0% GPU utilization value confirms a clean system. In this campaign, the monitoring infrastructure itself has been compromised, rendering otherwise trusted telemetry unreliable.

The discovery of SANSAR demonstrates how modern cryptojacking operations are evolving beyond simple resource theft into sophisticated intrusion frameworks that combine stealth, persistence, rootkit technology, remote administration, and blockchain-assisted command-and-control mechanisms. For defenders, detecting these compromises now requires validation of both system activity and the integrity of the tools used to observe it.