Attackers Abuse Legitimate GSocket Tool to Keep Linux Footholds

Attackers are using GSocket, a legitimate open-source remote-access utility, to hold onto Linux servers after exploiting initial flaws, according to BleepingComputer, citing Microsoft Defender for Endpoint telemetry. The report says malicious GSocket detections rose 356.2% between March and August, with most activity involving web applications and hosting systems.

The technique matters because it can outlast the vulnerability that let an attacker in. GSocket relays connections through the Global Socket Relay Network. In the observed model, both the compromised host and the operator make outbound connections to the relay, which pairs them and brokers an encrypted session. As a result, the server does not need an inbound listener, a public IP address, or a working NAT path for the operator to reconnect. According to Microsoft, that also removes the need for a dedicated command-and-control server.

Defenders relying on inbound firewall rules may therefore miss the traffic. The report says egress filtering and outbound monitoring are better placed to catch it, while IP- and domain-based allow/deny lists are harder to use because the attacker does not need the server's address or hostname to return.

Who is affected? The telemetry described by BleepingComputer points most heavily at web applications and hosting. Web apps and hosting accounted for 87.1% of detected incidents; PHP web apps and cPanel hosting made up 63.9%, and Apache 24.3%. By sector, education and research were most frequently targeted, followed by technology and communications, manufacturing, and government entities. Those figures describe detections in Microsoft telemetry, not a complete census of exposed Linux systems.

The report describes several persistence methods: disguising GSocket as kernel threads, and adding cron jobs, systemd services, and shell startup files. In some cases, attackers attempted to exploit the Linux kernel flaw tracked as CVE-2026-43284, described in the report as “Dirty Frag,” to obtain root privileges. The source says these were attempts; it does not state that every attempt succeeded.

What should administrators do? Microsoft's recommendations, as reported, are to remove GSocket and related files from potentially compromised servers, confirm that outbound connections to its relay network have stopped, limit outbound traffic to known destinations, and audit cron jobs, systemd services, and shell startup files for unauthorized changes. The report also advises keeping the OS and applications patched, including for CVE-2026-43284.

Patching alone is not presented as a cleanup step for an already persistent intrusion. The source says attackers use GSocket to maintain access even after the vulnerabilities used for initial access are fixed. The report does not describe a GSocket patch or allege a flaw in the tool itself; it describes abuse of a legitimate utility. That distinction matters for response: removing the implant and checking outbound behavior is different from waiting for a vendor fix.

The limitations are significant. The figures come from one vendor's telemetry as summarized by BleepingComputer, and the source does not provide independent confirmation, a full list of affected organizations, or evidence that every detection represents a confirmed compromise. The CVE identifier and its details should be checked against authoritative vulnerability records before operational use. The source material also includes promotional content and unrelated headlines, which were excluded.