Microsoft has uncovered that attackers are using the open‐source tool GSocket as a stealth backdoor to maintain access to Linux servers even after known vulnerabilities have been patched.
What is GSocket and How It’s Being Abused
GSocket is a remote administration utility that normally relays connections over a shared public relay network. Attackers are now modifying it to act as invisible persistence: instead of initiating incoming connections—which can be blocked or monitored—GSocket lets both the infected server and attacker reach out to the relay and communicate securely, concealing the connection from firewalls and bypassing the need for public network exposure.
The attack sequence typically starts with exploiting a flaw in a web-facing application. The attacker uses tools like curlto download a script and executes it via bash. The installer selects a GSocket client compatible with the system, places it in writable or memory‐backed directories such as /dev/shm, and then sets up methods of persistence. Because GSocket is independent of the compromised application, patching the vulnerability in the app often fails to remove the access.
Techniques, Trends and Targets
Attackers aren’t just reconnecting; they take steps to masquerade. In some instances, the GSocket client’s process is renamed to resemble kernel threads. They establish persistence using cron jobs, systemd units, shell configuration files, and watchdogs, and remove temporary ‘staging’ scripts to minimize traces. Some of these methods are reminiscent of fileless PHP web shells that hide in expected system paths to avoid detection.
Microsoft’s telemetry shows a dramatic rise in GSocket misuse: detections increased by 356.2% between March and August 2026. The tool is being used by multiple unrelated threat actors, according to a report released on November 11, 2026.
Who’s Most Affected & How to Defend Properly
Data reveals certain sectors are disproportionately impacted. Hosting systems running web applications comprise 87.1% of incidents. Of those, 63.9% use PHP applications or cPanel hosting, and 24.3% run Apache. Education and research institutions are the largest group affected, followed by technology and telecommunications firms. These organizations tend to have sprawling, sometimes unmanaged infrastructure that’s slow to patch.
Microsoft’s guidance emphasizes that patching a flaw without removing the backdoor is insufficient. Effective remediation requires deleting GSocket binaries, removing persistence artifacts, staging files, and ensuring no remaining outbound connections to the public relay network. Additional tactics: enforce deny-by-default rules for outbound traffic, mount memory-backed or temporary directories as non-executable, audit cron jobs, systemd units, and shell startup files, and enable real-time protection via endpoint defense tools designed for Linux.
Indicators of Compromise
Some of the artifacts security teams should watch include:
- Domains such as
gsocket.io,cdn.gsocket.io, andgsgg.b-cdn.netused to retrieve installers or scripts - URLs like
https://gsocket.io/install.shand architecture-specific payloads from listed CDN sources, especially for x86-64 and AArch64 - Hidden file paths under
/dev/shm/.gs-0/, or binaries named likegs-netcat_mini-linux-x86_64 - Files made to resemble systemd services (e.g.
/tmp/systemd-remount-d), or shell startup configuration that calls out to GSocket clients
Removing these artifacts and verifying that the system no longer reaches out to relay domains are essential steps for full recovery.
This emerging use of GSocket illustrates a key lesson: attackers often plant resilient footholds that survive basic patching. Even when vulnerabilities are fixed, adversaries may retain access. Organizations need processes not just for rapid patch deployment, but for thorough post‐patch audits. Rising detection rates suggest this trend will grow—security teams should watch for similar relay‐based backdoors, ensure endpoint tools cover Linux, and assume a breach isn’t remediated until every trace is gone.
