Threat video1:00
SANSAR Spoofs NVIDIA GPU Stats: Detection & IOCs
A malicious libnvidia-ml.so.1 wrapper fakes GPU load as XMRig and SRBMiner mine on Linux. Its 9 detection rules and 23 IOCs include a free Splunk SPL rule.
Read the full threat intel for SANSAR Spoofs NVIDIA GPU Stats: Detection & IOCs →
Chapters
- 0:00The hookMiners hid on three GPU hosts.
- 0:04The storyUnauthenticated Ray jobs got in.
- 0:10Attack pathReportedly a submitted job sent GPU inventory.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise16 indicators to hunt: 1 domain, 7 SHA-256 hashes and 2 file names, and more.
- 0:37MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:42Remediation5 steps now: Restrict Ray job agent / Jobs API to authenticated, internal-only.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Miners hid on three GPU hosts.
0:05Unauthenticated Ray jobs got in.
0:07Then they obtained root.
0:11Reportedly a submitted job sent GPU inventory.
0:14Then an SSH key and root.
0:17Toolkit staged on three hosts.
0:19A spoofed NVML faked GPU stats.
0:24No threat actor is attributed. Confidence: low.
0:2916 indicators to hunt: 1 domain, 7 SHA-256 hashes and 2 file names, and more.
0:3818 ATT&CK techniques, from initial access to impact.
0:435 steps now: Restrict Ray job agent / Jobs API to authenticated, internal-only.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.