Malware · 20h ago
Microsoft has seen multiple incidents in which attackers installed GSocket, an open-source remote-access tool, on compromised Linux servers to retain access after the vulnerabilities used to break in were fixed. Microsoft says its Defender for Endpoint telemetry shows use growing over recent months, with unrelated actors adopting the tool in web application and hosting environments.
GSocket keeps the connection alive by having both the compromised server and operator connect outward to a shared public relay, which bridges their sessions. The server needs no inbound listener, and the relay address is not controlled by the attacker; blocking attacker-owned IPs or domains can therefore leave the path open. GSocket can also install persistence that survives a reboot.
For teams running internet-facing Linux applications, a patched web flaw can close the original entry point while leaving a foothold on the host. If that server remains connected through the relay, the incident continues beyond the application fix and inherits the access available from that machine.
2 sources covering this story
Hackers plant GSocket on Linux servers for persistent access
Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access.
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched.
Part of the PlainSec briefing for 2026-11-13