Threat actors use GSocket to keep access after Linux web flaws are fixed
Original title: The global socket: how threat actors are weaponizing GSocket for stealthy C2
Defender detections rose 356.2% from March to August 2026, and patching the original web flaw does not remove the client.
Microsoft reported multiple cases in which threat actors installed GSocket, an open-source remote access tool, on compromised Linux servers so access survived remediation of the initial web flaws. Both the host and operator connect outbound to the public Global Socket Relay Network, so there is no attacker-owned IP or domain to block. From March through August 2026, related detections rose 356.2%, and web applications and hosting accounted for 87.1% of attributable incidents.
Unconfirmed: Microsoft says sector shares more likely reflect exposure than deliberate targeting.
- Education and research represented 30.7% of affected organizations.
- Technology and telecommunications accounted for 22.9%.
- Within web and hosting incidents, PHP and cPanel were 63.9% and Apache 24.3%.
- Actors used curl, staged clients in paths such as /dev/shm, and disguised process names.
- Persistence included cron, systemd, shell profiles, watchdogs, and redundant copies.
Impact: Persistent outbound command and control after web compromise
- 1.Hunt hosts for GSocket deployment, persistence, privilege escalation, and outbound relay connections.
- 2.Do not treat application patching alone as complete remediation.
- 3.Restrict and monitor egress to the Global Socket Relay Network.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.gsocket.io | cription gsocket[.]io Domain Script and installer retrieval cdn[.]gsocket[.]io Domain Client binary distribution gsgg[.]b-cdn[.]net Do |
| domain | gsgg.b-cdn.net | rieval cdn[.]gsocket[.]io Domain Client binary distribution gsgg[.]b-cdn[.]net Domain Client binary distribution hxxps://gsocket[.]io/ |
| domain | gsocket.io | ocket tooling or infrastructure. Indicator Type Description gsocket[.]io Domain Script and installer retrieval cdn[.]gsocket[.]io |
| sha256 | 12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c | 2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f", "12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c" ]); DeviceFileEvents | where Timestamp > ago(7d) | where S |
| sha256 | 55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f | 9e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5", "55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f", "12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f5 |
| sha256 | d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa | ndicators of compromise section. let badSHA256 = dynamic([ "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a |
| sha256 | f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5 | 0b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5", "55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa4 |
| url | https://cdn.gsocket.io/bin/gs-netcat_mini-linux-aarch64 | 4 URL Download source associated with the x86-64 file below hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64 URL Download source associated with the AArch64 file be |
| url | https://gsgg.b-cdn.net/bin/gs-netcat_mini-linux-x86_64 | ller retrieval target; successful retrieval not established hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64 URL Download source associated with the x86-64 file bel |
| url | https://gsocket.io/install.sh | ]io/y URL Script retrieval in download-and-execute commands hxxps://gsocket[.]io/install.sh URL Installer retrieval target; successful retrieval not |
| url | https://gsocket.io/y | bution gsgg[.]b-cdn[.]net Domain Client binary distribution hxxps://gsocket[.]io/y URL Script retrieval in download-and-execute commands hxx |
From the original article
11 min read at microsoft.com
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity. The post The global socket: how threat actors are weaponizing GSocket for stealthy C2 appeared first on Microsoft Security Blog.
By Yash Gund, Sumith Maniath and Microsoft Security Research · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.