# REF3364 SANSAR: Linux GPU Cryptomining Intrusion Falsifies NVIDIA GPU Telemetry via Malicious NVML Wrapper and ftrace Rootkit

> Elastic Security Labs tracks REF3364, an intrusion on three Linux GPU hosts that began with an internet-exposed, unauthenticated Ray job agent. The attacker deployed the SANSAR Rust orchestrator, a malicious libnvidia-ml.so.1 wrapper that reports falsified GPU utilization/temperature/power, and the acpi_thermal_mgr.ko ftrace rootkit to hide XMRig and SRBMiner miners, with C2 over Tor and Ethereum smart-contract lookups.

- **Published:** 2026-11-13T14:10:23Z
- **Last reviewed:** 2026-11-13T14:10:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5967
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5967.png
- **ID:** TL-2026-5967
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)

## Description

REF3364 is an intrusion against three Linux GPU hosts reported by Elastic Security Labs on 2026-11-12. Initial access was an open-source Ray job agent reachable from the internet that accepted job submissions without authentication (the Ray dashboard was bound to loopback only, but the Jobs API was exposed). External probes appeared in Ray logs on 2026-10-22; on 2026-10-24 a submitted job ran nvidia-smi and sent the GPU inventory to an external server; on 2026-10-25 a Python reverse-shell job connected to an external listener running as the Ray session owner. The actor then added an SSH key to that account's authorized_keys and obtained root (the source does not explain the privilege-escalation method) and staged the toolkit in /opt/vadi_ across the three hosts.

The toolkit centres on SANSAR, a Rust client (v0.1.3) that supervises miners and maintains the concealment components. SANSAR performs anti-analysis checks (non-zero TracerPid in /proc/self/status, and a 1,000-iteration timing loop that must finish in under 501 ms), decodes its C2 hostname from 62 obfuscated bytes (per-byte rotate right by (i%7)+1 then XOR with a repeating 32-byte mask), and reaches an onion controller on port 9051 through Arti (Rust Tor) in direct mode or through Lyrebird (obfs4/WebTunnel bridges; seven WebTunnel and three obfs4 entries). Registration uses a 40-byte auth field (big-endian timestamp plus HMAC-SHA256 over client ID and timestamp). The wire protocol uses a 4-byte big-endian length, 4-byte little-endian message type and payload, with 16 message types (0-15) covering registration, heartbeat, bridge updates, interactive PTY shells (/bin/bash --norc --noprofile with history disabled), a raw IPv4 TCP SYN stress/flood function, and miner start/stop/config/output control. Miners are renamed: kurt (XMRig 6.25.0, CPU) and tilki (SRBMiner-MULTI 3.6.9, GPU). Pool and wallet configuration is supplied by the controller; no hardcoded fallback exists.

To defeat GPU-utilization-based detection, a modified libnvidia-ml.so.1 (NVML) wrapper is built from /opt/vadi_/nvml-hook/nvml_hook.c via make/make install (ldconfig locates the NVIDIA library directory), forwards calls to the genuine library and then reports 0% GPU utilization, random temperatures of 36-46 C and random power of 100-200 W; GBHackers additionally reports process-information filtering affecting nvidia-smi. A backup is kept at /usr/lib/.libnvidia-ml.so.1.backup. The acpi_thermal_mgr.ko ftrace rootkit (source /usr/src/acpi_thermal_mgr-1.0/acpi_thermal_mgr.c, built via DKMS and reloaded at boot through an initramfs loader) hooks getdents/getdents64, open/openat, kill, sched_getaffinity-style PID queries and TCP/UDP socket listing to hide processes (default kurt and lyrebird), files and sockets; optional module self-hiding is off by default.

A separate systemd backdoor named netns performs eth_call requests over HTTPS to public Ethereum RPC services against contract 0x43eb291f56688c63c93e8a93c4591fc997cf6349 (selector 0x6ded96e7), decodes a controller IPv4 address, and connects over plain TCP port 8080. It accepts 'SHELL <host> <port>' to fork Bash to an arbitrary host, with no authentication or integrity checks. No CVE, CVSS score, threat-actor attribution, sector targeting, or Ray/NVIDIA version information is given in the sources. Because telemetry is falsified, apparently idle GPUs cannot establish that a host is clean; defenders should correlate Ray job submissions, SSH authorized_keys changes, NVIDIA library changes, DKMS artifacts, initramfs modifications and unexpected services, and use visibility outside the compromised kernel and user space.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1543.002 Create or Modify System Process: Systemd Service
- T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions
- T1014 Rootkit
- T1622 Debugger Evasion
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1690 Prevent Command History Logging
- T1082 System Information Discovery
- T1090.003 Proxy: Multi-hop Proxy
- T1102.001 Web Service: Dead Drop Resolver
- T1095 Non-Application Layer Protocol
- T1496.001 Resource Hijacking: Compute Hijacking
- T1498.001 Network Denial of Service: Direct Network Flood

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**REF3364 Ray Worker Spawning GPU Recon, Reverse Shell or SANSAR Staging Commands** (`TL-2026-5967-SPL-001`)

Detects child processes of Ray job workers / JobSupervisor that match the REF3364 intrusion chain: nvidia-smi --query-gpu inventory collection (2026-10-24 recon job), Python/bash reverse shells (2026-10-25 job), and commands touching /opt/vadi_ (SANSAR toolkit staging) or authorized_keys (SSH key persistence). The exposed unauthenticated Ray Jobs API (CWE-306) is the REF3364 initial-access vector.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.006, T1059.004, T1082, T1098.004
- **Data sources:** sysmon_for_linux (index=linux sourcetype=sysmon:linux), microsoft_defender_for_endpoint_linux (DeviceProcessEvents), sigma_linux_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
    (ParentCommandLine="*default_worker.py*" OR ParentCommandLine="*JobSupervisor*" OR ParentCommandLine="*ray::*" OR ParentImage="*/ray/*")
| eval ray_child_behavior=case(
    match(Image,"/nvidia-smi$") AND match(CommandLine,"--query-gpu"), "gpu_inventory_recon_nvidia_smi",
    match(CommandLine,"(?i)pty\\.spawn") OR match(CommandLine,"/dev/tcp/") OR (match(CommandLine,"(?i)socket") AND match(CommandLine,"(?i)connect") AND match(CommandLine,"(?i)(dup2|subprocess|/bin/(ba)?sh)")), "python_or_bash_reverse_shell",
    match(CommandLine,"/opt/vadi_|authorized_keys"), "sansar_staging_or_ssh_key_persistence",
    true(), null())
| where isnotnull(ray_child_behavior)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS cmdlines values(Image) AS child_images values(ray_child_behavior) AS behaviors BY host User ParentCommandLine
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine has_any ("default_worker.py", "JobSupervisor", "ray::")
| extend Behavior = case(
    FileName =~ "nvidia-smi" and ProcessCommandLine has "--query-gpu", "gpu_inventory_recon_nvidia_smi",
    ProcessCommandLine has "pty.spawn" or ProcessCommandLine has "/dev/tcp/" or (ProcessCommandLine has "socket" and ProcessCommandLine has "connect" and ProcessCommandLine has_any ("dup2", "subprocess", "/bin/sh", "/bin/bash")), "python_or_bash_reverse_shell",
    ProcessCommandLine has_any ("/opt/vadi_", "authorized_keys"), "sansar_staging_or_ssh_key_persistence",
    "")
| where Behavior != ""
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Behavior
| order by Timestamp desc
```

### Sigma

```yaml
title: REF3364 Ray Worker Spawning GPU Recon, Reverse Shell or SANSAR Staging
id: 5b1e7c52-2a34-4d6f-9a10-0c5967a00001
status: experimental
description: Detects child processes of Ray job workers or JobSupervisor running nvidia-smi --query-gpu, Python or bash reverse shells, or commands touching /opt/vadi_ and authorized_keys, as seen in the REF3364 SANSAR intrusion.
references:
    - https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.006
    - attack.t1059.004
    - attack.discovery
    - attack.t1082
    - attack.persistence
    - attack.t1098.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentCommandLine|contains:
            - 'default_worker.py'
            - 'JobSupervisor'
            - 'ray::'
    selection_gpu:
        Image|endswith: '/nvidia-smi'
        CommandLine|contains: '--query-gpu'
    selection_pty:
        CommandLine|contains: 'pty.spawn'
    selection_devtcp:
        CommandLine|contains: '/dev/tcp/'
    selection_pysock:
        CommandLine|contains|all:
            - 'socket'
            - 'connect'
        CommandLine|contains:
            - 'dup2'
            - 'subprocess'
            - '/bin/sh'
            - '/bin/bash'
    selection_staging:
        CommandLine|contains:
            - '/opt/vadi_'
            - 'authorized_keys'
    condition: selection_parent and (selection_gpu or selection_pty or selection_devtcp or selection_pysock or selection_staging)
falsepositives:
    - Legitimate Ray tasks that call nvidia-smi --query-gpu for GPU health checks
    - ML jobs that open sockets and spawn subprocesses for distributed training
level: high

```

**Known false positives:**

- Ray training/serving tasks that legitimately call nvidia-smi --query-gpu for GPU monitoring
- Ray cluster autoscaler or ops scripts that manage authorized_keys on worker nodes

**Tuning notes:** Baseline legitimate nvidia-smi callers under Ray (allow-list by user and exact command line) and keep the reverse-shell and /opt/vadi_ branches unfiltered. If Sysmon for Linux is not deployed, map to auditd EXECVE records (sourcetype linux:audit) with parent process enrichment. Schedule every 15 minutes over a 30-minute window.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- REF3364 Public Inbound Connections to Ray Jobs API / Dashboard Agent Ports (locked: unlock with TL Creds)
- REF3364 acpi_thermal_mgr ftrace Rootkit Module Load and DKMS Artifacts (locked: unlock with TL Creds)
- REF3364 Netns Backdoor: Ethereum RPC Dead Drop Lookup Followed by TCP [indicator] Controller Connection (locked: unlock with TL Creds)
- REF3364 External POST to Ray Jobs API Submitting Jobs Without Authentication (locked: unlock with TL Creds)
- REF3364 SSH authorized_keys Modification via Shell Command (locked: unlock with TL Creds)
- REF3364 Renamed Miners kurt (XMRig 6.25.0) and tilki (SRBMiner-MULTI 3.6.9) Execution (locked: unlock with TL Creds)
- REF3364 Malicious NVML Wrapper ([indicator]) Install and Backup Artifacts (locked: unlock with TL Creds)
- REF3364 SANSAR Tor C2 Client, Lyrebird Transport and PTY Shell Activity (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- Domain: `efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id[.]onion`
- File hash: `00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e`
- Domain: `api[.]ipify[.]org`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [0% GPU utilization: How SANSAR hides Linux cryptomining](https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware)
- [Hackers Manipulate NVIDIA GPU Monitoring to Conceal Cryptocurrency Mining on Compromised Linux Servers](https://gbhackers.com/nvidia-gpu-monitoring/)
- [MITRE ATT&CK T1014 Rootkit](https://attack.mitre.org/techniques/T1014/)
- [MITRE ATT&CK T1496.001 Resource Hijacking: Compute Hijacking](https://attack.mitre.org/techniques/T1496/001/)
- [MITRE ATT&CK T1102.001 Web Service: Dead Drop Resolver](https://attack.mitre.org/techniques/T1102/001/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5967