Summary
Microsoft reports that multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to keep access to Linux servers even after the flaw used for initial access has been patched. Microsoft Defender for Endpoint telemetry shows GSocket-related detections rose 356.2% between March and August.
How the Abuse Works
GSocket routes traffic through the Global Socket Relay Network. The compromised host and the operator both connect outbound to the relay, which brokers an end-to-end encrypted session.
- No inbound listener or public IP is needed on the victim host, so it works behind firewalls and NAT.
- There is no dedicated C2 server, so IP and domain blocklists are less effective.
- Attackers disguise the process as kernel threads.
- Persistence uses cron jobs, systemd services and shell startup files.
Because access survives patching, fixing the original vulnerability is not enough to evict the attacker.
Who Is Affected
| Metric | Figure |
|---|---|
| Incidents involving web apps and hosting | 87.1% |
| PHP web apps and cPanel | 63.9% |
| Apache | 24.3% |
| Top sectors | Education and research, technology and communications, manufacturing, government |
The initial-access flaws were not named. Some attackers also tried the Dirty Frag Linux kernel flaw, CVE-2026-43284, to gain root.
Recommended Actions
- Remove GSocket and its associated files from potentially affected servers.
- Confirm outbound connections to the GSocket relay network have stopped.
- Restrict egress to predetermined destinations; inbound firewall rules do not catch this traffic.
- Audit cron jobs, systemd services and shell startup files for unauthorized entries.
- Keep the OS and applications updated, including CVE-2026-43284.
No specific indicators of compromise were published in the report.
Source
BleepingComputer, citing Microsoft's blog post and Defender for Endpoint telemetry.