{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The SANSAR toolkit falsifies GPU use and uses kernel-level hiding to maintain persistent cryptomining; a negative result over the GPU estate is required to ensure resource integrity." }, "name": "SANSAR Stealth and Evasive C2 Channels", "type": "investigation", "labels": [ "hunt", "attack.t1059", "attack.t1090.003", "attack.t1496", "command and control", "defense evasion", "execution", "impact", "initial access", "persistence" ], "series": { "slug": "0-gpu-utilization-how-sansar-hides-linux-cryptomining", "index": 2, "title": "0% GPU utilization: How SANSAR hides Linux cryptomining", "total": 2 }, "related": [ { "hunt": "sansar-persistence-and-impact", "reason": "This hunt focuses on stealth and C2 channels; mining impact and systemd persistence are handled in a separate hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "ray-framework-exploitation-sansar-staging", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule for IP discovery or nvidia-smi queries is prone to noise; this hunt correlates these behaviors with kernel-level file indicators and library hook backups that an automated rule cannot easily link across multiple surfaces.", "coverage": [ { "stage": "defense-evasion-stealth-mechanisms", "steps": [ "rootkit-file-indicators", "gpu-telemetry-query" ], "status": "covered" }, { "stage": "c2-tor-and-ethereum", "steps": [ "ip-discovery-behavior" ], "status": "covered" }, { "stage": "initial-access-ray-job-agent", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" }, { "stage": "execution-reverse-shell", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" }, { "stage": "persistence-toolkit-deployment", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" }, { "stage": "impact-cryptomining", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Ray Job Agent Exploitation", "slug": "initial-access-ray-job-agent", "tactic": "initial-access", "techniques": [ "T1059" ], "observables": [ "Unauthenticated access to Ray Job API", "External probes in Ray logs", "Job submission to Ray head node" ] }, { "name": "Python Reverse Shell Execution", "slug": "execution-reverse-shell", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "nvidia-smi --query-gpu=name", "Python reverse-shell job submission", "Connection to external listener via Python" ] }, { "name": "Persistence and Toolkit Deployment", "slug": "persistence-toolkit-deployment", "tactic": "persistence", "techniques": [ "T1059" ], "observables": [ "Staging under /opt/vadi_/", "Modification of authorized_keys for SSH access", "netns backdoor registered as a systemd service", "acpi_thermal_mgr kernel module built via DKMS", "initramfs loader modification" ] }, { "name": "Stealth and Telemetry Falsification", "slug": "defense-evasion-stealth-mechanisms", "tactic": "defense-evasion", "techniques": [ "T1059" ], "observables": [ "acpi_thermal_mgr.ko loading", "Replacement of libnvidia-ml.so.1 with modified wrapper", "Presence of libnvidia-ml.so.1.backup", "SANSAR anti-debugging TracerPid check in /proc/self/status" ] }, { "name": "Evasive Command and Control", "slug": "c2-tor-and-ethereum", "tactic": "command-and-control", "techniques": [ "T1090.003" ], "observables": [ "efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id.onion:9051", "api.ipify.org", "ifconfig.me", "icanhazip.com", "checkip.amazonaws.com", "Lyrebird transport helper usage (obfs4, WebTunnel)", "Ethereum smart contract calls for netns C2 resolution" ] }, { "name": "Cryptomining Resource Hijacking", "slug": "impact-cryptomining", "tactic": "impact", "techniques": [ "T1496" ], "observables": [ "kurt (XMRig 6.25.0) process activity", "tilki (SRBMiner-MULTI 3.6.9) process activity", "Deployment of GPU mining contexts" ] } ], "summary": "Threat actor REF3364 targets Linux GPU hosts by exploiting unauthenticated Ray job agents to gain root access and persistent shell control. The campaign deploys the SANSAR toolkit, which employs a kernel rootkit to hide its presence and modified NVIDIA libraries to falsify GPU utilization while managing cryptomining and backdoors via Tor and Ethereum-based infrastructure." }, "severity": "high", "rationale": "Focus the hunt on Linux nodes with NVIDIA GPUs. Use the lead query result to populate scope_hosts for higher fidelity behavioral correlation.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has deployed a Linux rootkit and modified library wrappers to hide cryptomining while using Tor and external IP discovery services for orchestration.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined-scope", "kind": "manual", "observed": "2026-11-12" }, "type": "list[host]", "default": [], "description": "Narrow the hunt to specific hosts if the lead query is too broad." }, "lookback_days": { "from": { "ref": "analyst-standard", "kind": "manual", "observed": "2026-11-12" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "ip_check_domains": { "from": { "ref": "elastic-security-labs-sansar", "kind": "article", "observed": "2026-11-12" }, "type": "list[domain]", "default": [ "api.ipify.org", "ifconfig.me", "icanhazip.com", "checkip.amazonaws.com" ], "description": "External IP discovery services used by SANSAR for C2 bootstrapping." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic Security Labs \u2014 0% GPU utilization: How SANSAR hides Linux cryptomining" } ], "blind_spots": [ { "id": "kernel-module-hiding", "risk": "The acpi_thermal_mgr.ko rootkit hooks ftrace to hide itself; if successfully loaded, process and network telemetry from the host will be suppressed or falsified.", "stage": "defense-evasion-stealth-mechanisms", "question": "Can we see the miner process and socket if the rootkit is loaded?", "requires": "unhooked kernel-level auditing" }, { "id": "obfuscated-tor-traffic", "risk": "SANSAR's use of Lyrebird allows it to tunnel Tor traffic within standard HTTPS sessions, bypassing simple protocol-based filters.", "stage": "c2-tor-and-ethereum", "question": "Are obfs4 or WebTunnel bridges detectable?", "requires": "hb_network_connection with TLS fingerprinting" } ] }, "name": "SANSAR Stealth and Evasive C2 Channels", "description": "This hunt identifies the stealth mechanisms and evasive Command and Control channels of the SANSAR toolkit. It targets the installation of the acpi_thermal_mgr kernel module and the libnvidia-ml library hook used to falsify GPU telemetry. The flow correlates these stealth indicators with behavioral patterns such as specific GPU inventory queries and the use of external IP discovery services that precede Tor-based C2 communication." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "0-gpu-utilization-how-sansar-hides-linux-cryptomining", "index": 2, "title": "0% GPU utilization: How SANSAR hides Linux cryptomining", "total": 2 }, "coverage": [ { "stage": "defense-evasion-stealth-mechanisms", "steps": [ "rootkit-file-indicators", "gpu-telemetry-query" ], "status": "covered" }, { "stage": "c2-tor-and-ethereum", "steps": [ "ip-discovery-behavior" ], "status": "covered" }, { "stage": "initial-access-ray-job-agent", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" }, { "stage": "execution-reverse-shell", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" }, { "stage": "persistence-toolkit-deployment", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" }, { "stage": "impact-cryptomining", "reason": "Belongs to another part of the '0% GPU utilization: How SANSAR hides Linux cryptomining' series.", "status": "out_of_scope" } ], "rationale": "An adversary has deployed a Linux rootkit and modified library wrappers to hide cryptomining while using Tor and external IP discovery services for orchestration.", "blind_spots": [ { "id": "kernel-module-hiding", "risk": "The acpi_thermal_mgr.ko rootkit hooks ftrace to hide itself; if successfully loaded, process and network telemetry from the host will be suppressed or falsified.", "stage": "defense-evasion-stealth-mechanisms", "question": "Can we see the miner process and socket if the rootkit is loaded?", "requires": "unhooked kernel-level auditing" }, { "id": "obfuscated-tor-traffic", "risk": "SANSAR's use of Lyrebird allows it to tunnel Tor traffic within standard HTTPS sessions, bypassing simple protocol-based filters.", "stage": "c2-tor-and-ethereum", "question": "Are obfs4 or WebTunnel bridges detectable?", "requires": "hb_network_connection with TLS fingerprinting" } ], "scoping_notes": "Focus the hunt on Linux nodes with NVIDIA GPUs. Use the lead query result to populate scope_hosts for higher fidelity behavioral correlation.", "beyond_detection": "A single rule for IP discovery or nvidia-smi queries is prone to noise; this hunt correlates these behaviors with kernel-level file indicators and library hook backups that an automated rule cannot easily link across multiple surfaces." } }, { "id": "rootkit-file-indicators", "type": "query", "label": "Detect rootkit and library hook indicators", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, file_path, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%acpi_thermal_mgr.ko%' OR LOWER(file_path) LIKE '%libnvidia-ml.so.1.backup%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify hosts with the SANSAR kernel module or the modified NVML library backup file.", "expected_signal": "Rows indicating the presence of the toolkit files. Silence suggests these specific names were not used or are hidden by a functional rootkit." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Detect rootkit and library hook indicators", "reads": [ "device_hostname", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%acpi_thermal_mgr.ko%' OR LOWER(file_path) LIKE '%libnvidia-ml.so.1.backup%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows indicating the presence of the toolkit files. Silence suggests these specific names were not used or are hidden by a functional rootkit.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "ip-discovery-behavior", "type": "query", "label": "DNS lookups to IP discovery services", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as count FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{ip_check_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify the sequence of IP discovery attempts SANSAR uses to bootstrap its Tor connection.", "expected_signal": "DNS queries to multiple services from the list on a single host." }, "parents": [ { "id": "rootkit-file-indicators" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS lookups to IP discovery services", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as count FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{ip_check_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "DNS queries to multiple services from the list on a single host.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "gpu-telemetry-query", "type": "query", "label": "Unusual GPU inventory commands", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, COUNT(*) as count, MIN(time) as first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(process_cmd_line) LIKE '%--query-gpu=name%' AND LOWER(process_cmd_line) LIKE '%--format=csv,noheader%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_cmd_line", "surface": "hb_process_activity", "description": "Identify the specific nvidia-smi telemetry query used by the SANSAR orchestrator to select miners.", "expected_signal": "A specific csv-formatted query command that matches SANSAR's internal logic." }, "parents": [ { "id": "rootkit-file-indicators" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Unusual GPU inventory commands", "reads": [ "device_hostname", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, COUNT(*) as count, MIN(time) as first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(process_cmd_line) LIKE '%--query-gpu=name%' AND LOWER(process_cmd_line) LIKE '%--format=csv,noheader%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_cmd_line", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A specific csv-formatted query command that matches SANSAR's internal logic.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-11-13" } }, { "id": "triage-agent", "type": "analytic", "label": "Analyze SANSAR presence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "rootkit-file-indicators", "ip-discovery-behavior", "gpu-telemetry-query" ], "objective": "Evaluate whether the file indicators (acpi_thermal_mgr or library backups) intersect with IP discovery DNS lookups and specific GPU inventory queries to confirm SANSAR toolkit deployment.", "description": "Weigh file, DNS, and process indicators to determine if a host is compromised by the toolkit.", "max_iterations": 3, "expected_signal": "A confirmed verdict per host citing the intersection of stealth and behavioral evidence.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing evidence from at least two surfaces." }, "parents": [ { "id": "ip-discovery-behavior", "kind": "merge" }, { "id": "gpu-telemetry-query", "kind": "merge" } ] }, { "id": "verdict-decision", "type": "checkpoint", "label": "Route on triage results", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage-agent verdict is malicious for at least one host.", "condition": "The triage-agent verdict is malicious for at least one host.", "blind_spot": "kernel-module-hiding", "confidence": "high", "description": "Direct the analyst to action or further manual review based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate Linux host", "config": { "target": "endpoint", "description": "Prevent SANSAR from communicating with its Tor C2 or Ethereum discovery addresses.", "instructions": "Isolate the host at the network layer. Preserve current process memory to capture the rootkit in its unhidden state. Do not reboot, as this triggers the initramfs persistence module.", "action_approval": "required" }, "parents": [ { "id": "verdict-decision", "branch": "on_supports" } ] }, { "id": "forensic-investigation", "type": "task", "label": "Forensic review and sample collection", "config": { "assignee": "analyst", "description": "Analyze the host to extract the SANSAR orchestrator and the acpi_thermal_mgr kernel module.", "instructions": "Manually inspect /opt/vadi_ for the sansar and netns binaries. Extract the acpi_thermal_mgr.ko module from the boot image or RAM. Review network logs for Ethereum smart contract interactions linked to the netns backdoor." }, "parents": [ { "id": "verdict-decision", "branch": "default" }, { "id": "verdict-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "completion-task", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document the results and update baseline for GPU telemetry queries.", "instructions": "Record whether the nvidia-smi queries were legitimate administrative activity. Document any observed rootkit samples to improve kernel-module load detections." }, "parents": [ { "id": "verdict-decision", "branch": "on_refutes" }, { "id": "forensic-investigation" } ] } ] }