On a hijacked GPU server, the monitoring tools said the cards were idle: 0% utilization, a calm 36 to 46 degrees Celsius, 100 to 200 watts. Those numbers came from a swapped-in system library, while the GPUs were mining cryptocurrency for an intruder, Elastic Security Labs reports.
Elastic tracks the intrusion as REF3364, and the way in was an AI tool. Ray is an open-source framework for spreading Python workloads, including AI model training and inference, across many machines, and its Jobs API lets users submit commands to run on the cluster. On the first host, Ray's dashboard listened only on the local loopback interface, but the job agent was reachable from the internet and accepted job submissions without authentication. The attacker went on to obtain root and deploy the toolkit across three Linux GPU hosts. It is not the first time Ray has given attackers a foothold: a separate Ray flaw was exploited earlier this year.
Four days from first probe to a foothold
Ray's logs record external probes on October 22, 2026. On October 24 a submitted job ran nvidia-smi and sent the server's GPU inventory to an external server. On October 25 the actor submitted a Python reverse-shell job and then added an SSH key to the Ray account's authorized_keys file for persistent access. After gaining root, the actor staged the toolkit under /opt/vadi_.
A miner manager that only talks over Tor
The centrepiece is SANSAR, a Rust program (sansar-client 0.1.3) that takes orders from an onion service, using Arti, the Tor Project's Rust implementation of Tor, with optional obfs4 and WebTunnel bridges through Lyrebird. It supervises two off-the-shelf miners renamed on disk: kurt, which is XMRig 6.25.0 for CPUs, and tilki, an unmodified SRBMiner-MULTI 3.6.9 for GPUs. SANSAR handles 16 command types, including interactive Bash shells with history logging suppressed and a task that sends raw TCP SYN traffic at a chosen address and port. It exits if it detects a debugger.
Three more components keep the operation out of sight:
- a modified copy of libnvidia-ml.so.1, the NVIDIA management library (NVML) that nvidia-smi relies on, which forwards queries to the genuine library and then reports GPU utilization as 0% with random temperature and power values;
- acpi_thermal_mgr, an ftrace-based kernel rootkit built through DKMS with an initramfs loader so it can load again at boot, which hides selected processes, files and socket entries;
- netns, a separate backdoor that reads its controller's IPv4 address from an Ethereum smart contract, connects to it on TCP port 8080 and can spawn reverse shells on command.
The rootkit's source code contains Turkish comments, Elastic notes. Cryptominers on Linux are nothing new, as earlier campaigns showed, but falsifying GPU telemetry targets exactly the expensive hardware that AI teams are now buying.
Lock down who can submit Ray jobs
Elastic's advice for organizations expanding GPU infrastructure for AI and LLM workloads is to check who can submit jobs and whether GPU monitoring libraries have been modified. Concretely:
- make sure the Ray job agent is not reachable from the internet without authentication; in this case a loopback-only dashboard did not protect the exposed agent;
- check whether libnvidia-ml.so.1 has been replaced, and look for a backup at /usr/lib/.libnvidia-ml.so.1.backup;
- look for /opt/vadi_, an acpi_thermal_mgr module source under /usr/src/acpi_thermal_mgr-1.0/, and an unexpected netns systemd service;
- use the YARA rules Elastic published for SANSAR and netns.
Indicators
- Tor C2: efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id[.]onion port 9051
- Ethereum contract used to look up the netns controller: 0x43eb291f56688c63c93e8a93c4591fc997cf6349
- SHA-256 from Elastic's observables: 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e, 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46, acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7
A dashboard is only as honest as the library feeding it. On GPU clusters, the job queue and the files on disk are now better evidence than the utilization graph.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.