Attackers are using GSocket, a legitimate open-source remote access tool, to retain control of compromised Linux servers after administrators patch the vulnerabilities used to break in. In a November 11 report, Microsoft described multiple intrusions in which the tool survived application remediation, requiring defenders to investigate the host and remove persistence as well as fix the original flaw.
The activity particularly affects web applications and hosting environments. Microsoft Defender for Endpoint telemetry showed a 356.2% increase in devices with GSocket-related detections from March through August 2026, although growth varied between months. That measures devices with detections, rather than a count of confirmed successful intrusions.
BleepingComputer reported on November 12, citing Microsoft, that 87.1% of detected incidents related to web applications and hosting. It reported shares of 63.9% for PHP web applications and cPanel hosting, and 24.3% for Apache. Education and research were the most targeted sector, followed by technology and communications, manufacturing, and government.
How access survives a patch
Microsoft observed attackers exploiting internet-facing applications to execute commands under the web service’s account, then deploying GSocket. Because the relay client runs independently of the vulnerable application, patching that application does not remove the client or the mechanisms that restart it.
GSocket routes traffic through the Global Socket Relay Network, a shared public service. The compromised server and the attacker each initiate an outbound connection to a relay, which pairs them over an end-to-end encrypted channel. The server needs neither an inbound listening service nor a public IP address. Network address translation, which lets systems share an external address, does not prevent the connection.
This gives attackers remote access without operating a dedicated command-and-control server—the infrastructure normally used to direct compromised systems. They can reconnect without knowing the compromised server’s IP address or hostname. There is consequently no attacker-owned address or domain for defenders to block, although organizations can restrict access to the relay network itself.
Inbound firewall rules do not catch this outbound traffic. Outbound filtering and monitoring can.
Microsoft said multiple unrelated threat actors have adopted GSocket. Its deployment script can rename processes, place files in memory-backed directories and install mechanisms intended to survive a reboot. Researchers observed attackers disguising processes as Linux kernel threads and using cron scheduled jobs, systemd services and shell startup files to maintain access. Persistence across reboot and successful relay sessions were not confirmed in every analyzed intrusion.
In some cases, attackers also attempted to exploit the Linux kernel vulnerability CVE-2026-43284, described by BleepingComputer as “Dirty Frag,” to move from the web-service account to root, Linux’s highest-privilege account. Microsoft described these as exploitation attempts.
What defenders can look for
Microsoft’s observed alerts covered suspicious shells launched by web servers and application runtimes, GSocket execution, payload downloads, cron jobs and newly created Linux services. Other signals included hidden-file execution, obfuscation, changed timestamps, deletion of running binaries, attempts to clear command history, system reconnaissance and reverse-shell behavior. An individual alert does not establish the initial access route or prove that every intrusion stage succeeded.
For example, Microsoft observed a bash command invoking the renamed payload /usr/bin/defunct, alongside references to defunct.service and a multi-user.target.wants link used to enable a systemd service. This illustrates why administrators need to inspect plausible-looking service names as well as recognizable GSocket filenames.
Microsoft published Defender XDR hunting queries covering the previous seven days. They search process names and command lines for gs-netcat, gsocket, gsnetcat and gsocket.io, then expose the account, path and parent process for investigation. Other queries check download activity and network connections involving gsocket.io and gsgg.b-cdn.net.
Those domains, along with cdn.gsocket.io, distribute the legitimate tool; they are not attacker-owned command-and-control infrastructure. Observed retrieval targets included hxxps://gsocket[.]io/y and hxxps://gsocket[.]io/install.sh, though successful retrieval from the latter was not established.
File searches cover paths beginning /dev/shm/.gs- and names including systemd-remount-d, .gsn_ora, defunct and defunct.service. Microsoft also published these specific file observations and SHA-256 fingerprints:
/dev/shm/.gs-0/gs-netcat_mini-linux-x86_64:d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa/dev/shm/.gs-0/gs-netcat_mini-linux-aarch64:f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5/tmp/systemd-remount-dand/usr/bin/systemd-remount-d:55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f/tmp/.gsn_ora:12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c
The architecture-specific binaries were associated with downloads from hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64 and hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64. These indicators represent particular observations, rather than a complete inventory. Microsoft advises investigating matches alongside process ancestry, execution context, persistence changes and network activity.
Remove the foothold as well as the flaw
Administrators investigating affected Linux servers should remove the unauthorized GSocket client, staged files and associated persistence, then verify that outbound connections to the relay infrastructure have stopped, Microsoft recommends. Stopping the running process alone may leave other restart mechanisms intact.
The company also recommends reviewing cron entries, systemd units and shell startup files; applying deny-by-default outbound rules that allow only required destinations; and monitoring relay connections. Where feasible, temporary and memory-backed directories should be mounted as non-executable, with alerts for execution from hidden or world-writable paths.
Internet-facing applications, content management systems, plugins and application servers should be kept current. Microsoft advises removing unused components and restricting upload and administrative paths. Administrators should also prioritize local privilege-escalation patches, including CVE-2026-43284. As separate context for that recommendation, Microsoft cited FORGE Lab’s work on 59 Linux kernel bug reports, including eight vulnerabilities with local root exploits demonstrated in controlled environments.
For organizations using Defender for Endpoint on Linux, Microsoft recommends keeping real-time protection, cloud-delivered protection and behavior monitoring enabled, including monitoring for unusual child processes of web services and disguised process identities. Application patching should be followed by host cleanup and verification that the relay connections have ended.
