As reported by Elastic Security Labs, researchers have documented REF3364, a multi-component Linux cryptomining intrusion centered on a Rust orchestrator dubbed SANSAR. What makes this campaign noteworthy is not the mining itself — it's the layered stealth architecture and the specific targeting of GPU-rich AI/ML infrastructure that defenders may not be monitoring as closely as traditional endpoints.

Threat Alert: As reported by Elastic Security Labs, researchers have documented REF3364, a multi-component Linux cryptomining intrusion centered on a Rust orchestrator dubbed SANSAR.

Why This Matters Beyond Another Cryptominer

Cryptominers are frequently dismissed as nuisance-level threats — a resource-drain problem rather than a data-exfiltration crisis. That framing misses the real risk in AI/ML environments. A compromised GPU host often sits inside environments housing proprietary model weights, training datasets, and research code. The initial access vector here was an exposed Ray job agent without authentication, which gave the attacker root. From there, the toolkit deployed a kernel rootkit (acpi_thermal_mgr) for hiding processes and files, an NVML wrapper that spoofs GPU utilization readings to 0%, and a separate backdoor (netns) that resolves its C2 address via an Ethereum smart contract before connecting directly.

This is a blueprint for persistent, stealthy access to high-value compute — not just for mining, but as a staging platform for espionage, lateral movement, or supply chain compromise. Any organization running Ray clusters for distributed ML workloads should treat this as a direct warning.

The Blockchain C2 Pattern Demands Attention

Using public blockchains for C2 address resolution is a resilience mechanism: it removes the single point of failure that traditional DNS or hardcoded IPs represent, and it's auditable by anyone with the contract address but extremely difficult to sinkhole.

Elastic notes this pattern appeared in their 2026 quarterly report, suggesting growing adoption among threat actors who need infrastructure that survives takedowns. Defenders relying on DNS-based threat intelligence feeds will miss this traffic entirely — the initial beacon goes to a public RPC endpoint, not an attacker-controlled domain.

Stealth Stack Analysis

The evasion design is deliberately stacked across three layers:

  • Kernel rootkit (acpi_thermal_mgr): Hides selected processes, files, and socket entries from standard system tools — meaning ps, ls, and netstat won't show the miner or its network connections.
  • NVML wrapper: Falsifies GPU utilization readings so that operators checking nvidia-smi or monitoring dashboards see 0% GPU load even while mining is consuming the hardware.
  • Tor-based C2: All orchestrator communication routes through Tor, blending traffic with legitimate anonymity-seeking users and complicating network-based detection.

For teams that rely on GPU utilization metrics as a primary indicator of mining activity — which is many teams — the NVML wrapper effectively blinds the most common detection signal. This is the kind of gap that makes GPU-monitoring-based alerting insufficient on its own.

Shield53 Recommendations

Immediate Actions:

  • Audit Ray deployments: Inventory all Ray job agents and head nodes. Ensure job APIs are never exposed to the internet without authentication. Ray's dashboard should bind to localhost only, and job agent endpoints must require auth — not be reachable from external networks.
  • Network segmentation: ML compute clusters should not have job submission APIs routable from the public internet. Use bastion hosts, VPN, or private networking for any cluster access.
  • SSH key hygiene: Review authorized_keys on all GPU hosts for unauthorized entries. The attacker added a key for persistence — this is one of the first things to check if you suspect compromise.
  • Kernel module monitoring: Inventory loaded kernel modules with lsmod and check for unexpected DKMS-built modules. The rootkit was built via DKMS and named acpi_thermal_mgr to blend in — a name that looks plausible but isn't a standard thermal management module on most distributions.
  • Multi-signal GPU monitoring: Don't rely solely on NVML-reported utilization. Cross-reference with power draw readings, PCIe bandwidth counters, and thermal sensors. If power consumption is high but NVML reports 0% utilization, treat it as a tampering indicator.
  • Blockchain RPC egress monitoring: Flag outbound connections to public Ethereum RPC endpoints (Infura, Alchemy, public nodes) from GPU compute hosts that have no legitimate reason to query blockchain data. This is your best early indicator of the netns-style C2 pattern.
  • Endpoint detection: Deploy EDR with Linux kernel module monitoring capabilities. Standard file-based scanning will miss a rootkit that hides its own artifacts.

Broader takeaway: AI infrastructure security is still immature in most organizations. The combination of high-value compute, exposed orchestration frameworks, and teams focused on model performance rather than host hardening makes ML clusters an attractive and under-defended target. Treat GPU hosts with the same security posture you apply to production database servers — because the blast radius is comparable.