Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage

Attackers exploited an internet-exposed Ray job agent that required no authentication, allowing them to submit malicious remote computing jobs without any credentials. Once inside, they deployed the SANSAR toolkit — a sophisticated combination of a Rust-based controller, a kernel rootkit, and a tampered NVIDIA monitoring library — to mine cryptocurrency while making GPU utilization appear to be 0% in monitoring dashboards. This attack demonstrates that even robust monitoring infrastructure can be rendered blind when adversaries can manipulate the data sources themselves at the kernel or library level. The incident matters because GPU servers are high-value targets, and the ability to fake telemetry means organizations may remain unaware of ongoing resource theft and intrusion for extended periods.