0% GPU utilization: How SANSAR hides Linux cryptomining
Elastic Security Labs analyzes SANSAR, a Linux cryptomining orchestrator that manages miners over Tor, alongside a kernel rootkit, GPU monitoring hooks and a backdoor that retrieves its C2 address from Ethereum.
Summary from Elastic Security Labs.
Explained
The technology and terms in this story. Learn more
- TechnologyTorA network that hides who is talking to whom by relaying traffic through three volunteer-run servers.
- AttackRootkitMalware that hides itself deep in the operating system to avoid detection.
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
- ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.