Elastic Security Labs · Published 12 Nov
0% GPU utilization: How SANSAR hides Linux cryptomining
By Salim Bitam
Excerpt
Elastic Security Labs is tracking REF3364, a Linux cryptomining intrusion that combines custom malware with publicly available miners. The toolkit includes SANSAR, a Rust orchestrator that receives commands over Tor (The Onion Router) used to manage CPU and GPU miners.
The threat actor also deployed a kernel rootkit to hide selected processes and files, an NVIDIA Management Library (NVML) wrapper to falsify GPU readings, and a separate backdoor named netns . This backdoor retrieves its C2 address from an Ethereum smart contract before connecting to the server directly.…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt3
More from Elastic Security Labs10
Elastic Security Labs · Web page · Published 26 Mar
The Shelby Strategy
The SHELBY malware family abuses GitHub for command-and-control, stealing data and retrieving commands The attacker’s C2 design has a critical flaw: anyone with the PAT token can control infected machines, exposing a significant security vulnerability Unused…
Elastic Security Labs · Web page · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Elastic Security Labs · Web page · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Elastic Security Labs · Web page · Published 14 Apr
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…
On the same topics
Group-IB · Web page · Published 14 Oct
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Group-IB researchers have identified and analyzed KGB RAT, a Windows-targeting Remote Access Trojan (RAT) that has been actively promoted across underground hacking forums since at least late-2025. Marketed under the guise of a legitimate Remote…
polyswarm.io · Web page · Added 14 Nov
ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish persistent access and convert compromised systems into…
ThreatFabric · Web page · Published 1 Oct
Hirudo: From Fake Updates to Patched Banking Apps
ThreatFabric's Mobile Threat Intelligence team has identified a new Android banking remote access trojan we track as Hirudo. Hirudo combines on-device credential theft with live remote control of the same phone, and it is delivered by shopping and…
helpnetsecurity.com · Web page · Published 12 Nov
Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers. Each page showed what looked like a routine verification check. Behind it, the page quietly copied a…