The SANSAR Linux cryptomining intrusion is a sophisticated malware operation that uses a Rust-based orchestrator to manage CPU and GPU miners via Tor. Attackers exploited an exposed Ray job agent to gain root access on Linux GPU hosts, deploying a kernel rootkit to hide processes and files. It includes an NVIDIA Management Library wrapper that falsifies GPU telemetry to show 0% utilization, concealing cryptomining activity. The malware also uses a backdoor named netns to retrieve command and control addresses from Ethereum smart contracts. SANSAR controls XMRig and SRBMiner-MULTI miners and maintains command handlers for configuration and interactive shells. Multiple stealth techniques such as ftrace-based rootkit hooks, modified GPU monitoring libraries, and Tor-based communications with bridge support enhance anonymity and evasion.