Attackers use GSocket to retain access to Linux servers
Multiple threat actors have been using GSocket to keep access to Linux servers since at least March, including after administrators patch the vulnerabilities used to gain entry, BleepingComputer reported. The activity has increased in attacks against web applications and hosting environments, according to the report.
Microsoft Defender for Endpoint telemetry showed a 356.2% increase in GSocket-related detections between March and August, Microsoft said. Web applications and hosting accounted for 87.1% of detected incidents. PHP web applications and cPanel hosting represented 63.9%, while Apache accounted for 24.3%, according to the researchers.
GSocket is a legitimate open-source remote access tool, but attackers are using it to route connections through the Global Socket Relay Network, according to BleepingComputer. The compromised server and the attacker each make an outbound connection to the relay, which matches the connections and brokers an end-to-end encrypted session, Microsoft explained.
That setup lets an attacker reconnect without knowing the server’s IP address or hostname. Microsoft said the server needs no inbound listener or public IP address, and network address translation does not block the connection. The model also removes the need for a dedicated command-and-control server, according to Microsoft.
Microsoft said inbound firewall rules do not catch the malicious traffic because both sides connect outward. Egress filtering, which restricts outbound connections, and monitoring of outbound traffic can help identify the activity, the company said. The relay-based design also makes IP- and domain-based access controls less effective, according to Microsoft.
The researchers observed attackers disguising GSocket as kernel threads and using cron jobs, systemd services and shell startup files to preserve access. In some cases, attackers attempted to exploit Dirty Frag, a Linux kernel flaw tracked as CVE-2026-43284, to obtain root privileges, BleepingComputer reported.
Microsoft researchers recommended removing GSocket and associated files from potentially affected servers and checking that connections to its relay network have stopped. They also advised restricting outbound traffic to predetermined destinations and auditing cron jobs, systemd services and shell startup files for unauthorized additions. Keeping operating systems and applications updated, including with patches for CVE-2026-43284, was among the measures they recommended.