GSocket is a legitimate open-source remote access tool that is being exploited by multiple threat actors to remain undetected even after the vulnerabilities used to gain entry have been patched. As a result of this activity, attackers are developing independent access channels that remain active after the initial security breach, highlighting the growing post-compromise threat.
Microsoft released a report on November 11, 2026 detailing malicious use of GSocket across Linux environments in significant numbers. Microsoft Defender for Endpoint telemetry reports a 356.2% increase in detections of GSocket-related attacks between March and August 2026. The attacks primarily affected internet-facing web applications as well as hosting infrastructure.
As a networking utility, GSO sockets were originally developed to allow remote communication between systems behind firewalls and Network Address Translation (NAT) devices. As a result of these networking capabilities, attackers are establishing encrypted command-and-control connections via GSRNV through the Global Socket Relay Network in an attempt to exploit its capabilities.
In contrast to conventional remote access methods, GSocket does not require attackers to directly access compromised servers.
By establishing outbound connections to the shared relay network, both the infected host and the operator are able to communicate. In addition to eliminating the need for an exposed inbound port, a public IP address, or a dedicated C2 server controlled by an attacker, this communication model also diminishes conventional network defense capabilities.
A firewall rule that identifies inbound connections cannot easily identify these connections, and blocking individual IP addresses or domains may not interfere with access as traffic passes through a shared relay system. However, egress filtering and outbound traffic monitoring can be useful for identifying or preventing suspicious communications.
Most detected activities occur in web hosting environments
An analysis conducted by Microsoft determined that web applications and hosting environments contributed 87.1% to the number of incidents attributed to GSocket. PHP web applications and cPanel hosting accounted for 63.9% of incidents, while Apache environments contributed 24.3%. In conclusion, these findings indicate that internet-facing Linux infrastructure is a significant target of this activity.
GSocket is typically downloaded and launched through shell commands by attackers using vulnerabilities in exposed web applications. Once deployed, the tool operates independently of the vulnerable application. As a result, patching the original security flaw or restarting the affected service does not terminate or remove the malicious client or terminate its access channel automatically.
According to Microsoft, education and research organizations accounted for 30.7% of affected organizations, followed by technology and telecommunications with 22.9%.
Attackers Establish Multiple Persistence Mechanisms
Following the initial compromise, Microsoft found that attackers used a number of methods to maintain GSocket running. These malicious processes were renamed in order to appear to be legitimate Linux kernel threads or system services, which made them less noticeable during routine system checks. In some cases, hidden files were also installed in temporary or memory-backed directories to facilitate the deployment process.
There were some intrusions involving watchdog processes and duplicate copies of the tool, which enabled access to be restored if one instance was removed. Persistence was established by cron jobs, systemd services, and shell startup files. As part of their efforts to complicate investigations, attackers also deleted installation files and other traces of deployment.
Moreover, the research identified attempts to exploit the Linux kernel vulnerability CVE-2026-43284, commonly referred to as Dirty Frag, which can allow attackers to elevate their privileges from a web-service account to root. This was observed in a limited number of incidents, but success in escalation of privilege was not always observed.
Shared relay network complicates blocking
GSocket identifies and authenticates its endpoints utilizing a shared secret rather than a fixed IP address. During installation, a secret is generated and made available to the operator in a variety of ways. By using that information, the attacker can connect to the compromised server using a client that is compatible with the Global Socket Relay Network, regardless of the network address of the compromised server changing.
Consequently, conventional IP-based blocking is less reliable due to the shared relay infrastructure, rather than controlled by a single attacker. Therefore, blocking an attacker's address may not interrupt the connection, which makes conventional IP-based blocking less reliable. Nevertheless, Microsoft stated that monitoring outbound traffic and imposing
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
GSocket Backdoor Allows Hackers to Retain Remote Control Over Linux Servers