Elastic Security Labs is tracking REF3364, a Linux cryptomining intrusion that combines custom malware with publicly available miners. The toolkit includes SANSAR, a Rust orchestrator that receives commands over Tor (The Onion Router) used to manage CPU and GPU miners. The threat actor also deployed a kernel rootkit to hide selected processes and files, an NVIDIA Management Library (NVML) wrapper to falsify GPU readings, and a separate backdoor named netns.
0% GPU utilization: How SANSAR hides Linux cryptomining
About this summary. This is a short excerpt from the description that Elastic Security Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware
Source attribution: headline and facts are from Elastic Security Labs (elastic.co). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they…
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…
The global socket: how threat actors are weaponizing GSocket for stealthy C2
When one RCE stops being just one RCE Observed attack chains How threat actors deploy and operate GSocket How GSocket reconnects without a fixed C2 address Mitigation…
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
Hackers are actively exploiting a recently discovered critical vulnerability that allows them to log in to privileged accounts on many Linux systems, multiple…
Claude Code extension poisoned with persistent SSH backdoor
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm…
Fake Kernel Threads Are Hiding Backdoors on Linux Servers and Appliances
Attackers keep disguising malware as Linux kernel worker processes, but careful checks will expose the disguise On September 5, 2026, Sansec, a security firm that…