0% GPU utilization: How SANSAR hides Linux cryptomining

The SANSAR Linux cryptomining intrusion is a sophisticated malware operation that uses a Rust-based orchestrator to manage CPU and GPU miners via Tor. Attackers exploited an exposed Ray job agent to gain root access on Linux GPU hosts, deploying a kernel rootkit to hide processes and files. It includes an NVIDIA Management Library wrapper that falsifies GPU telemetry to show 0% utilization, concealing cryptomining activity. The malware also uses a backdoor named netns to retrieve command and control addresses from Ethereum smart contracts. SANSAR controls XMRig and SRBMiner-MULTI miners and maintains command handlers for configuration and interactive shells. Multiple stealth techniques such as ftrace-based rootkit hooks, modified GPU monitoring libraries, and Tor-based communications with bridge support enhance anonymity and evasion.

• Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 ImplantMalware2026-11-09
• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig CryptominerMalware2026-10-09
• Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026Malware2026-10-14
• CVE-2026-105133: Ahsay AhsayCBS · Improper AuthenticationHighVulnerability2026-10-04
• Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own FilesMalware2026-09-08