SANSAR: Linux cryptomining orchestrator with kernel rootkit, Tor C2 and Ethereum-based backdoor
Severity: medium · Patch status: no-fix-needed · Since 2026-11-12
Elastic Security Labs published analysis of SANSAR, a Linux cryptomining orchestrator that manages miners over Tor to conceal command-and-control traffic. The toolkit includes a kernel rootkit for stealth, hooks that spoof GPU monitoring so administrators see 0% GPU utilization despite active mining, and a backdoor that retrieves its C2 address from the Ethereum blockchain. Organizations running Linux servers, especially GPU-equipped hosts, are potential targets; the malware's goal is covert cryptocurrency mining and persistent access. No vendor patch applies; detection and hardening are the mitigations.
What to do
- Hunt for signs of kernel rootkits and unexpected kernel modules on Linux hosts
- Monitor GPU utilization and compare with process/CPU activity for discrepancies
- Block or monitor Tor traffic and connections to Ethereum RPC endpoints from servers
- Check for unauthorized cryptominer processes and persistence mechanisms
- Keep EDR/kernel integrity monitoring enabled and review Elastic's published indicators of compromise
Sources
All live incidents on Threat Watch
