Hackers plant GSocket on Linux servers for persistent access

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access.

Since March, detections of malicious GSocket activity have increased, particularly in attacks targeting web applications and hosting environments.

GSocket allows attackers to reach systems behind firewalls or NAT by intercepting network connections and replacing the program's conventional IP-layer communication with its own transport layer, which routes traffic through the Global Socket Relay Network.

Since both endpoints initiate outbound connections to the relay, which matches them and brokers an end-to-end encrypted session, an attacker can reconnect without needing the compromised server's IP address or hostname.

This makes it more difficult for defenders to disrupt attacks using IP- or domain-based access control lists.

According to Microsoft Defender for Endpoint telemetry, GSocket-related detections increased by 356.2% between March and August.

Microsoft explains that both the compromised server and the attacker connect outbound, hence the server needs no inbound listener implants, making the attack stealthier.

“The compromised host and the operator both connect outbound to the relay, which bridges the two sessions,” Microsoft explains.

“The host needs no inbound listener or public IP address, and network address translation does not prevent the connection.”

The same model also removes the need for attackers to use a dedicated command-and-control (C2) server.

Microsoft says inbound firewall rules don’t catch the malicious traffic, although egress filtering and outbound monitoring can.

Of the detected incidents, 87.1% related to web applications and hosting. PHP web apps and cPanel hosting accounted for 63.9%, and Apache accounted for 24.3%.

The researchers observed attackers disguising GSocket as kernel threads and using cron jobs, systemd services, and shell startup files for persistence purposes.

In some cases, the attackers attempted to exploit the “Dirty Frag” Linux kernel flaw (CVE-2026-43284) to gain root privileges on the host.

Microsoft says most targets of GSocket activity are in the education and research sector, followed by technology and communications, manufacturing, and government entities.

The researchers recommend that system administrators remove GSocket and associated files from potentially impacted servers, and verify that outbound connections to its relay network have stopped.

They also advise restricting outbound traffic to predetermined destinations and auditing cron jobs, systemd services, and shell startup files for rogue additions.

Generally, keeping the OS and applications up to date, including patching for CVE-2026-43284, is a strong measure against this and other attacks.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.