Elastic Security Labs traced SANSAR, a Linux cryptomining toolkit, to three GPU hosts compromised through an internet-reachable Ray job agent that accepted jobs without authentication.
SANSAR’s NVIDIA Management Library (NVML) wrapper sits between monitoring software and NVIDIA’s library, substituting false readings. That means nvidia-smi can show 0% GPU use while miners continue. A kernel rootkit also hides selected processes and files, making ordinary host inspection less dependable.
If Ray clusters feed GPU-cost dashboards, the exposure does not end at the job agent: compromised hosts can keep mining while the NVIDIA signal used to spot it says they are idle.
Linux cryptomining malware: Inside the SANSAR toolkit
Attackers reached three GPU hosts through an exposed Ray job agent, then deployed Linux cryptomining malware that makes nvidia-smi report 0% utilization.