[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvDVN75-cej3_NmwSWIC8rg2krkzm0_0AgEfejU1BbYU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"053df967-4bf2-4cdc-a4f7-9b3d6ac764e0","unauthenticated-ray-agent-enables-hidden-gpu-crypto-mining-via-rootkit","d2e23017-21b3-48b9-9dcb-a52849f38a01","Unauthenticated Ray Agent Enables Hidden GPU Crypto Mining via Rootkit","Attackers exploited an internet-exposed Ray job agent that required no authentication, allowing them to submit malicious remote computing jobs without any credentials. Once inside, they deployed the SANSAR toolkit — a sophisticated combination of a Rust-based controller, a kernel rootkit, and a tampered NVIDIA monitoring library — to mine cryptocurrency while making GPU utilization appear to be 0% in monitoring dashboards. This attack demonstrates that even robust monitoring infrastructure can be rendered blind when adversaries can manipulate the data sources themselves at the kernel or library level. The incident matters because GPU servers are high-value targets, and the ability to fake telemetry means organizations may remain unaware of ongoing resource theft and intrusion for extended periods.","**Immediate actions:**\n- Require authentication and authorization on all Ray job agent endpoints, treating them as privileged interfaces even in internal or research environments.\n- Audit all GPU servers for unexpected processes, kernel modules, and replaced system libraries that could indicate a rootkit or tampering.\n- Rotate credentials and revoke access tokens on any system exposed to the internet without authentication.\n\n**Long-term improvements:**\n- Enforce network-level controls (firewall rules, private VPC placement) so that distributed computing frameworks like Ray are never directly reachable from the public internet.\n- Implement integrity monitoring on critical system libraries (e.g., NVIDIA NVML) and kernel modules to detect unauthorized replacements or modifications.\n- Apply the principle of least privilege to all compute cluster APIs, requiring mutual TLS or token-based authentication before any job submission is accepted.\n\n**Detection measures:**\n- Collect GPU utilization metrics from multiple independent sources (hypervisor level, out-of-band IPMI, cloud provider metrics) so a tampered in-guest library cannot be the sole data source.\n- Deploy behavioral anomaly detection on network egress and power\u002Fthermal telemetry to flag mining activity even when software-level metrics are spoofed.\n- Use kernel integrity verification tools (e.g., IMA\u002FEVM on Linux) to detect unauthorized kernel module loading consistent with rootkit installation.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1014: Rootkit","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"MITRE ATT&CK T1014: Rootkit":19,"CIS Control 13: Network Monitoring and Defense":20,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":22},"The exposed Ray endpoint lacked any access control; NIS2 Article 21(2)(i) requires organizations to implement access control policies for information systems, which would have mandated authentication on this interface.","SANSAR deploys a kernel rootkit specifically to hide malicious GPU activity from monitoring tools, matching ATT&CK's definition of rootkits used to conceal attacker presence and resource abuse.","The rootkit blinded in-guest GPU monitoring; CIS Control 13 calls for collecting telemetry from multiple vantage points so that a single tampered source cannot defeat detection.","The SANSAR toolkit replaced a legitimate NVIDIA monitoring library with a tampered version; SI-7 requires integrity verification mechanisms that would have detected this unauthorized substitution.","The Ray job agent was left in an unauthenticated default state; CIS Control 4 requires that insecure default configurations be hardened before deployment to prevent exactly this kind of unauthorized access.","published","2026-11-13T16:21:40.757567+00:00","2026-11-13T16:21:40.741+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-sansar-linux-malware\u002F","hackers-use-sansar-linux-malware-to-hide-crypto-mining-by-faking-0-gpu-usage-7ad699","Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[45,49,53],{"slug":46,"name":47,"problem":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]