0% GPU utilization: How SANSAR hides Linux cryptomining

* The threat involves SANSAR, a Rust orchestrator managing CPU and GPU miners over Tor with a kernel rootkit, NVML wrapper, and a netns backdoor.
* Initial access was achieved via an exposed Ray job agent to gain root access on three Linux GPU hosts.
* SANSAR uses Tor for C2 and supervises CPU and GPU miners.
* The toolkit included the acpithermalmgr kernel module and an initramfs loader to persist the rootkit.
* The NVIDIA Management Library (NVML) wrapper modifies GPU telemetry, reporting 0% utilization while falsifying temperature and power readings with random values.
* The kernel rootkit conceals processes, files, and socket entries by hooking system calls like getdents64 and openat.
* SANSAR communicates C2 over Tor using the Arti library and an encoded onion service domain.
* The netns backdoor retrieves its C2 address from an Ethereum smart contract via HTTPS RPC services.
* GPU enumeration uses nvidia-smi and external IP discovery services to determine host addresses.
* A binary protocol is used for C2 communication, including shell session handling and miner control commands.

The narrative outlines a sophisticated chain of compromise where initial access via an exposed orchestration framework leads to deep system-level persistence through kernel-level manipulation. The pattern suggests adversaries prioritize stealth and exfiltration of compute resources in environments optimized for high-performance workloads, leveraging the inherent trust within cloud/cluster environments (like Ray) as the entry point. The combination of a full-stack C2 mechanism (Tor), low-level kernel hiding (rootkit), and blockchain-based credential retrieval (Ethereum) demonstrates an intent to establish resilient, layered control over compromised infrastructure. The deliberate obfuscation—falsifying GPU metrics while hiding processes via ftrace hooks—serves the dual purpose of obscuring malicious activity from monitoring systems and masking operational presence. This reflects a pattern where commodity tools are weaponized by layering low-level exploits with high-level networking protocols to achieve autonomous, stealthy cryptojacking operations. The implications point toward a significant risk for organizations relying on workload distribution frameworks and GPU monitoring tools, necessitating a shift in security focus from perimeter defense to deep host integrity verification and monitoring of hardware telemetry.
Bridge Questions: If the initial access vector (Ray job agent) is patched, how quickly can an adversary pivot to discovering new, less monitored initial entry points within the cluster? How can organizations effectively monitor for subtle deviations in NVML or kernel behavior that might indicate a system-level hook without relying solely on signature-based detection? What alternative methods exist for verifying the integrity of system calls when rootkits are suspected, bypassing the compromised kernel itself?