[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo6qRrDm8nGXDc_YUh8uVeCoA4v1wRjgBUuoj5rUmn_c":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d2e23017-21b3-48b9-9dcb-a52849f38a01","Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage","hackers-use-sansar-linux-malware-to-hide-crypto-mining-by-faking-0-gpu-usage-7ad699","Hackers are hiding cryptocurrency mining on Linux GPU servers by changing the readings administrators use to spot heavy workloads. The toolkit combines a Rust-based controller called SANSAR, a kernel rootkit, and a modified NVIDIA monitoring library that reports 0% GPU utilization while mining continues in the background. The intrusion reached three Linux GPU hosts through […] The post Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage appeared first on Cyber Security News.","Hackers are using a toolkit called SANSAR to hide cryptocurrency mining on Linux GPU servers by manipulating monitoring data. The toolkit includes a Rust-based controller, a kernel rootkit, and a modified NVIDIA monitoring library that reports zero GPU utilization while mining continues. The intrusion was facilitated through an exposed Ray job agent that accepted unauthenticated remote computing jobs.","Hackers use SANSAR Linux malware to hide crypto mining by faking 0% GPU usage.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-sansar-linux-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-SANSAR-Linux-Malware-to-Hide-Crypto-Mining-by-Faking-0-GPU-Usage.webp","2026-11-13T15:09:45+00:00","2026-11-13T16:00:26.906022+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"SANSAR","product",{"name":21,"type":22},"Linux GPU servers","technology",{"name":24,"type":22},"NVIDIA Management Library",{"name":26,"type":19},"nvidia-smi",{"name":28,"type":19},"XMRig",{"name":30,"type":19},"SRBMiner-MULTI","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":35,"value":18,"context":56},"Rust-based controller used in the crypto mining malware toolkit.",[18,26,28],{"controls":59,"vendors":146},[60,88,117],{"slug":61,"name":62,"problem":63,"products":64},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[65,73,80],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":75,"url":78,"description":79},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":118,"name":119,"problem":120,"products":121},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"unauthenticated-ray-agent-enables-hidden-gpu-crypto-mining-via-rootkit","Unauthenticated Ray Agent Enables Hidden GPU Crypto Mining via Rootkit","Attackers exploited an internet-exposed Ray job agent that required no authentication, allowing them to submit malicious remote computing jobs without any credentials. Once inside, they deployed the SANSAR toolkit — a sophisticated combination of a Rust-based controller, a kernel rootkit, and a tampered NVIDIA monitoring library — to mine cryptocurrency while making GPU utilization appear to be 0% in monitoring dashboards. This attack demonstrates that even robust monitoring infrastructure can be rendered blind when adversaries can manipulate the data sources themselves at the kernel or library level. The incident matters because GPU servers are high-value targets, and the ability to fake telemetry means organizations may remain unaware of ongoing resource theft and intrusion for extended periods.",[158,159,160,161,162],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1014: Rootkit","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":164,"MITRE ATT&CK T1014: Rootkit":165,"CIS Control 13: Network Monitoring and Defense":166,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":167,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":168},"The exposed Ray endpoint lacked any access control; NIS2 Article 21(2)(i) requires organizations to implement access control policies for information systems, which would have mandated authentication on this interface.","SANSAR deploys a kernel rootkit specifically to hide malicious GPU activity from monitoring tools, matching ATT&CK's definition of rootkits used to conceal attacker presence and resource abuse.","The rootkit blinded in-guest GPU monitoring; CIS Control 13 calls for collecting telemetry from multiple vantage points so that a single tampered source cannot defeat detection.","The SANSAR toolkit replaced a legitimate NVIDIA monitoring library with a tampered version; SI-7 requires integrity verification mechanisms that would have detected this unauthorized substitution.","The Ray job agent was left in an unauthenticated default state; CIS Control 4 requires that insecure default configurations be hardened before deployment to prevent exactly this kind of unauthorized access."]