REF3364 SANSAR: Linux GPU Cryptomining Intrusion Falsifies NVIDIA GPU Telemetry via Malicious NVML Wrapper and ftrace Rootkit

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5967 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: REF3364 Ray Worker Spawning GPU Recon, Reverse Shell or SANSAR Staging Commands

Detects child processes of Ray job workers / JobSupervisor that match the REF3364 intrusion chain: nvidia-smi --query-gpu inventory collection (2026-10-24 recon job), Python/bash reverse shells (2026-10-25 job), and commands touching /opt/vadi_ (SANSAR toolkit staging) or authorized_keys (SSH key persistence). The exposed unauthenticated Ray Jobs API (CWE-306) is the REF3364 initial-access vector.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.006, T1059.004, T1082, T1098.004
• Data sources: sysmon_for_linux (index=linux sourcetype=sysmon:linux), microsoft_defender_for_endpoint_linux (DeviceProcessEvents), sigma_linux_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
    (ParentCommandLine="*default_worker.py*" OR ParentCommandLine="*JobSupervisor*" OR ParentCommandLine="*ray::*" OR ParentImage="*/ray/*")
| eval ray_child_behavior=case(
    match(Image,"/nvidia-smi$") AND match(CommandLine,"--query-gpu"), "gpu_inventory_recon_nvidia_smi",
    match(CommandLine,"(?i)pty\\.spawn") OR match(CommandLine,"/dev/tcp/") OR (match(CommandLine,"(?i)socket") AND match(CommandLine,"(?i)connect") AND match(CommandLine,"(?i)(dup2|subprocess|/bin/(ba)?sh)")), "python_or_bash_reverse_shell",
    match(CommandLine,"/opt/vadi_|authorized_keys"), "sansar_staging_or_ssh_key_persistence",
    true(), null())
| where isnotnull(ray_child_behavior)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS cmdlines values(Image) AS child_images values(ray_child_behavior) AS behaviors BY host User ParentCommandLine
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine has_any ("default_worker.py", "JobSupervisor", "ray::")
| extend Behavior = case(
    FileName =~ "nvidia-smi" and ProcessCommandLine has "--query-gpu", "gpu_inventory_recon_nvidia_smi",
    ProcessCommandLine has "pty.spawn" or ProcessCommandLine has "/dev/tcp/" or (ProcessCommandLine has "socket" and ProcessCommandLine has "connect" and ProcessCommandLine has_any ("dup2", "subprocess", "/bin/sh", "/bin/bash")), "python_or_bash_reverse_shell",
    ProcessCommandLine has_any ("/opt/vadi_", "authorized_keys"), "sansar_staging_or_ssh_key_persistence",
    "")
| where Behavior != ""
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Behavior
| order by Timestamp desc

Sigma

title: REF3364 Ray Worker Spawning GPU Recon, Reverse Shell or SANSAR Staging
id: 5b1e7c52-2a34-4d6f-9a10-0c5967a00001
status: experimental
description: Detects child processes of Ray job workers or JobSupervisor running nvidia-smi --query-gpu, Python or bash reverse shells, or commands touching /opt/vadi_ and authorized_keys, as seen in the REF3364 SANSAR intrusion.
references:
    - https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.006
    - attack.t1059.004
    - attack.discovery
    - attack.t1082
    - attack.persistence
    - attack.t1098.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentCommandLine|contains:
            - 'default_worker.py'
            - 'JobSupervisor'
            - 'ray::'
    selection_gpu:
        Image|endswith: '/nvidia-smi'
        CommandLine|contains: '--query-gpu'
    selection_pty:
        CommandLine|contains: 'pty.spawn'
    selection_devtcp:
        CommandLine|contains: '/dev/tcp/'
    selection_pysock:
        CommandLine|contains|all:
            - 'socket'
            - 'connect'
        CommandLine|contains:
            - 'dup2'
            - 'subprocess'
            - '/bin/sh'
            - '/bin/bash'
    selection_staging:
        CommandLine|contains:
            - '/opt/vadi_'
            - 'authorized_keys'
    condition: selection_parent and (selection_gpu or selection_pty or selection_devtcp or selection_pysock or selection_staging)
falsepositives:
    - Legitimate Ray tasks that call nvidia-smi --query-gpu for GPU health checks
    - ML jobs that open sockets and spawn subprocesses for distributed training
level: high

Known false positives:

• Ray training/serving tasks that legitimately call nvidia-smi --query-gpu for GPU monitoring
• Ray cluster autoscaler or ops scripts that manage authorized_keys on worker nodes

Tuning notes: Baseline legitimate nvidia-smi callers under Ray (allow-list by user and exact command line) and keep the reverse-shell and /opt/vadi_ branches unfiltered. If Sysmon for Linux is not deployed, map to auditd EXECVE records (sourcetype linux:audit) with parent process enrichment. Schedule every 15 minutes over a 30-minute window.

• 🔒 REF3364 Public Inbound Connections to Ray Jobs API / Dashboard Agent Ports · unlock with TL Creds
• 🔒 REF3364 acpi_thermal_mgr ftrace Rootkit Module Load and DKMS Artifacts · unlock with TL Creds
• 🔒 REF3364 Netns Backdoor: Ethereum RPC Dead Drop Lookup Followed by TCP [indicator] Controller Connection · unlock with TL Creds
• 🔒 REF3364 External POST to Ray Jobs API Submitting Jobs Without Authentication · unlock with TL Creds
• 🔒 REF3364 SSH authorized_keys Modification via Shell Command · unlock with TL Creds
• 🔒 REF3364 Renamed Miners kurt (XMRig 6.25.0) and tilki (SRBMiner-MULTI 3.6.9) Execution · unlock with TL Creds
• 🔒 REF3364 Malicious NVML Wrapper ([indicator]) Install and Backup Artifacts · unlock with TL Creds
• 🔒 REF3364 SANSAR Tor C2 Client, Lyrebird Transport and PTY Shell Activity · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5967.

Sample indicators (3 of 23)

• Domain: efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id[.]onion
• File hash: 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e
• Domain: api[.]ipify[.]org

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

Technical analysis

REF3364 is an intrusion against three Linux GPU hosts reported by Elastic Security Labs on 2026-11-12. Initial access was an open-source Ray job agent reachable from the internet that accepted job submissions without authentication (the Ray dashboard was bound to loopback only, but the Jobs API was exposed). External probes appeared in Ray logs on 2026-10-22; on 2026-10-24 a submitted job ran nvidia-smi and sent the GPU inventory to an external server; on 2026-10-25 a Python reverse-shell job connected to an external listener running as the Ray session owner. The actor then added an SSH key to that account's authorized_keys and obtained root (the source does not explain the privilege-escalation method) and staged the toolkit in /opt/vadi_ across the three hosts.

The toolkit centres on SANSAR, a Rust client (v0.1.3) that supervises miners and maintains the concealment components. SANSAR performs anti-analysis checks (non-zero TracerPid in /proc/self/status, and a 1,000-iteration timing loop that must finish in under 501 ms), decodes its C2 hostname from 62 obfuscated bytes (per-byte rotate right by (i%7)+1 then XOR with a repeating 32-byte mask), and reaches an onion controller on port 9051 through Arti (Rust Tor) in direct mode or through Lyrebird (obfs4/WebTunnel bridges; seven WebTunnel and three obfs4 entries). Registration uses a 40-byte auth field (big-endian timestamp plus HMAC-SHA256 over client ID and timestamp). The wire protocol uses a 4-byte big-endian length, 4-byte little-endian message type and payload, with 16 message types (0-15) covering registration, heartbeat, bridge updates, interactive PTY shells (/bin/bash --norc --noprofile with history disabled), a raw IPv4 TCP SYN stress/flood function, and miner start/stop/config/output control. Miners are renamed: kurt (XMRig 6.25.0, CPU) and tilki (SRBMiner-MULTI 3.6.9, GPU). Pool and wallet configuration is supplied by the controller; no hardcoded fallback exists.

To defeat GPU-utilization-based detection, a modified libnvidia-ml.so.1 (NVML) wrapper is built from /opt/vadi_/nvml-hook/nvml_hook.c via make/make install (ldconfig locates the NVIDIA library directory), forwards calls to the genuine library and then reports 0% GPU utilization, random temperatures of 36-46 C and random power of 100-200 W; GBHackers additionally reports process-information filtering affecting nvidia-smi. A backup is kept at /usr/lib/.libnvidia-ml.so.1.backup. The acpi_thermal_mgr.ko ftrace rootkit (source /usr/src/acpi_thermal_mgr-1.0/acpi_thermal_mgr.c, built via DKMS and reloaded at boot through an initramfs loader) hooks getdents/getdents64, open/openat, kill, sched_getaffinity-style PID queries and TCP/UDP socket listing to hide processes (default kurt and lyrebird), files and sockets; optional module self-hiding is off by default.

A separate systemd backdoor named netns performs eth_call requests over HTTPS to public Ethereum RPC services against contract 0x43eb291f56688c63c93e8a93c4591fc997cf6349 (selector 0x6ded96e7), decodes a controller IPv4 address, and connects over plain TCP port 8080. It accepts 'SHELL <host> <port>' to fork Bash to an arbitrary host, with no authentication or integrity checks. No CVE, CVSS score, threat-actor attribution, sector targeting, or Ray/NVIDIA version information is given in the sources. Because telemetry is falsified, apparently idle GPUs cannot establish that a host is clean; defenders should correlate Ray job submissions, SSH authorized_keys changes, NVIDIA library changes, DKMS artifacts, initramfs modifications and unexpected services, and use visibility outside the compromised kernel and user space.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1622 Debugger Evasion

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

Discovery

T1082 System Information Discovery

Command and Control

T1090.003 Proxy: Multi-hop Proxy; T1095 Non-Application Layer Protocol; T1102.001 Web Service: Dead Drop Resolver

Persistence

T1098.004 Account Manipulation: SSH Authorized Keys; T1543.002 Create or Modify System Process: Systemd Service; T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496.001 Resource Hijacking: Compute Hijacking; T1498.001 Network Denial of Service: Direct Network Flood

defense-impairment

T1690 Prevent Command History Logging

Remediation

Immediate actions

• Restrict Ray job agent / Jobs API to authenticated, internal-only access and remove internet exposure
• Review Ray job submission logs for activity from 2026-10-22 onward (nvidia-smi inventory jobs, Python reverse shells)
• Audit authorized_keys files for unexpected SSH keys on accounts that own Ray sessions
• Hunt for /opt/vadi_, the netns systemd service, acpi_thermal_mgr DKMS/initramfs artifacts and /usr/lib/.libnvidia-ml.so.1.backup
• Deploy Elastic YARA rules Linux_Trojan_Sansar_11eea454 and Linux_Trojan_Netns_c94a4b17 and block the published SHA-256 hashes

Workarounds

• Network-segment GPU/AI cluster management interfaces and place Ray behind authentication or a VPN
• Rebuild affected hosts from known-good media rather than cleaning in place, since a kernel rootkit hides artifacts

Longer-term hardening

• Do not rely on GPU utilization, temperature or power telemetry alone to conclude a host is clean; use independent visibility outside the compromised kernel and user space
• Monitor integrity of NVIDIA libraries (libnvidia-ml.so.1), DKMS modules and initramfs images
• Alert on kernel module loads and on outbound Tor, obfs4/WebTunnel bridge and Ethereum RPC traffic from GPU/AI hosts

Affected and fixed versions

• Ray (open source) — Ray job agent / Jobs API exposed without authentication
  Vulnerable versions: Internet-exposed unauthenticated deployments (versions not stated in source)
• Linux — Linux GPU hosts with NVIDIA drivers (NVML libnvidia-ml.so.1)
  Vulnerable versions: Not stated in source

Timeline

• 2026-10-22 External probes against the internet-exposed Ray job agent appear in Ray logs.
• 2026-10-24 A submitted Ray job runs nvidia-smi and sends the GPU inventory to an external server.
• 2026-10-25 After the shell and SSH key persistence, the actor obtains root (method not explained in source) and stages the toolkit in locked-ioc-15 on three Linux GPU hosts; exact dates of later stages are not stated.
• 2026-10-25 A Python reverse-shell Ray job connects to an external listener; the actor then adds an SSH key to the session account's authorized_keys.
• 2026-11-12 Elastic Security Labs publishes the REF3364 / SANSAR analysis with IOCs and two YARA rules.
• 2026-11-13 GBHackers reports on the campaign and the falsified NVIDIA GPU telemetry.

Sources cited

• 0% GPU utilization: How SANSAR hides Linux cryptomining elastic.co · Research · 2026-11-12
• MITRE ATT&CK T1014 Rootkit MITRE · Research · 2026-11-12
• MITRE ATT&CK T1496.001 Resource Hijacking: Compute Hijacking MITRE · Research · 2026-11-12
• MITRE ATT&CK T1102.001 Web Service: Dead Drop Resolver MITRE · Research · 2026-11-12
• Hackers Manipulate NVIDIA GPU Monitoring to Conceal Cryptocurrency Mining on Compromised Linux Servers gbhackers.com · News · 2026-11-13

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• Macfinger ClickFix campaign delivers DownTheDRAIN crypto-draining infostealer for macOS Previous report
• Fake GTA 6 PC download delivers WARDEN Stealer (Steam, Roblox, browser and crypto wallet data theft) Next report